UODO fines controller PLN 31,507 for failing to provide information under Art. 58(1) GDPR

https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. NOT FINAL Warsaw, September 1, 2026 Decision DKE.561.7.2026 Pursuant to Art. 104 § 1 of the Act of June 14, 1960—Code of Administrative Procedure [1] (hereinafter referred to as the “Code of Administrative Procedure”) in conjunction with Article 7(1) and (2), Article 60, and Article 101 of the Act of May 10, 2018, on data protection [2] (hereinafter referred to as “PDPA”), as well as pursuant to Article 57(1)(a) and (h), Article 58(2)(i), Article 83(1)-(2), and Article 83(5)(e) in conjunction with Article 58(1)(a) and (e) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [3] (hereinafter referred to as “Regulation 2016/679”), following an ex officio administrative proceeding concerning the imposition of an administrative fine on Mr. M. T., conducting business activity under the name “C. (…)” (formerly “D. (…)”) (ul. (…), (…)-(…) Z.), the President of the Personal Data Protection Office (hereinafter referred to as “the President of the PDPA” or “the supervisory authority”): finding that Mr. M. T., conducting business under the name “C. (…),” of Article 58(1)(a) and (e) of Regulation 2016/679, consisting of a failure to provide access to the personal data and information necessary for the President of the UODO to perform his duties in the proceedings bearing reference number DKN.5101.8.2025.(…), imposes an administrative fine on him in the amount of 31,507 PLN (in words: thirty-one thousand five hundred seven zlotys). Decision DKE.561.7.2026 The website2 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. Statement of Reasons I. Facts The President of the Personal Data Protection Office (UODO) received information indicating possible irregularities related to the operation of the website (…) and the associated website (…), which are used for data processing of individuals (…) and individuals (…). The report received by the President of the UODO indicated that the aforementioned websites were used for the processing of personal data regarding: first name, last name, and specific occupation in connection with misleadinginformation (occupation, contact details, location and manner of conducting professional practice) and articles suggesting that the person in question was their author. The President of the UODO also learned that both the website (…) and the website (…) failed to disclose the identity and contact information of the controller, which prevented the individuals whose data was being processed from effectively exercising their rights regarding privacy and personal data protection. The above information prompted the President of the UODO to initiate an investigation under case number DKN. 5101.8.2025.(…). The findings of the President of the Personal Data Protection Office (UODO) indicated that the operations of the websites (…) and (…), which were the subject of the reported irregularities, are linked to the business activities conducted by Mr. M. T. under the name “D. (…)” (currently: “C. (…)”). In view of the above, by a letter dated February 3, 2025, addressed to the service address disclosed in the Central Register and Information on Business Activity (hereinafter referred to as “CE-IDG”), i.e., (…), (…)-(…) Z., the President of the Personal Data Protection Office (UODO) notified Mr. M. T., conducting business under the name “D. (…)” (currently: “C. (…)”) (hereinafter referred to as the “Party,” “Controller,” “Entrepreneur”) that it had obtained the information referred to in point 1 of the preamble and informed him of the investigative proceedings conducted under case no. DKN.5101.8.2025.(…). The supervisory authority, acting pursuant to Article 58(1)( (a) and (e) of Regulation 2016/679, also requested the Party to provide explanations by answering the questions detailed in the letter, including, among other things, identifying the controller of the websites (…) and (…). In a letter dated February 26, 2025, the Party responded to the supervisory authority’s request. In its explanations, the Business confirmed, among other things, that it is the controller of the personal data processed through the website (…), and also addressed the remaining questions posed by the President of the Personal Data Protection Office (UODO). Decision DKE.561.7.2026 The website3 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. The explanations provided by the Party proved insufficient; consequently, the President of the Personal Data Protection Office (UODO) issued further requests to the Controller on April 9, 2025, and November 6, 2025, to provide additional explanations, to which the Party responded in letters dated May 2, 2025, (the date of the electronic signature indicated in the letter) and December 5, 2025. Nor did the Party’s additional explanations referred to above allow for the findings necessary to resolve the issues that are the subject of the proceedings under case no. DKN.5101.8.2025.(…), therefore, in letters dated March 20, 2026, and April 15, 2026, the supervisory authority, pursuant to Art. 58(1)(a) and (e) of Regulation 2016/679, again requested the Controller to supplement its explanations by answering the following questions:

Who is currently the controller, and who determines the purposes and means of personal data processing on the website (…);

How did the entity (…) assume the role of data controller for the websites in the https://(…) domains? 3) whether, and if so, on what basis, the personal data contained on the website https://(…)/ was transferred out of Poland (given that this data is currently also available at the address: (…), i.e., on a domain registered in (…)); 4) whether the obligation to inform (…)—whose data is processed on the D. portal— regarding the transfer of such data outside Poland and the EU has been fulfilled. In the requests, the authority set a deadline of 3 days from the date of delivery of the letters for the Controller to respond. The summons dated March 20, 2026, was sent to the Business Owner’s address for service of process disclosed in the CEIDG, i.e., ul. (…), (…)-(…) Z.. However, this letter was notified only once, on March 26, 2026, and was subsequently returned to the UODO on April 14, 2026. In light of the above, the authority sent another letter to the Party on April 15, 2026, which was also mailed to the address for service disclosed in the CEIDG. After two unsuccessful attempts to serve the letter (on April 21, 2026, and April 28, 2026), it was returned to the UODO with the notation “RETURNED—not accepted within the time limit”; however, it must be deemed to have been served on the Party—in accordance with Art. 44, § 1 and 4 of the Code of Administrative Procedure —by way of substitute service, as of May 5, 2026. In a letter dated April 15, 2026, the Controller was informed that failure to respond to the request could result in the imposition of an administrative fine pursuant to Article 83(5)(e) of Regulation 2016/679. This warning was also included in the supervisory authority’s letters dated April 9, 2025, and November 6, 2025, referred to in point 4 of the explanatory memorandum. The Party did not respond to the request from the President of the Personal Data Protection Office (UODO) dated April 15, 2026. Due to the Party’s failure to respond to the letter addressed to it, on May 15, 2026, an employee of the UODO’s Department of Penalties and Enforcement (hereinafter “DKE”) sent an email to the addresses (…) (the address provided in the Party’s explanations dated February 26, 2025), (…) (the email address disclosed in the CEIDG), and (…) (the address listed on the Decision DKE.561.7.2026 The website4 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. the Entrepreneur’s website disclosed in the CEIDG). The message asked the Entrepreneur to contact the UODO in connection with the proceedings under case no. DKN. 5101.8.2025.(…). On the same day, a reply was sent from the address (…) with attached screenshots showing a message (regarding the email sent by a DKE employee) explaining that the recipient could report an attempted scam if they believed the message might be a form of phishing. In response to this message, the DKE employee informed the recipient that, in case of doubt regarding the sender’s identity, it is possible to contact the UODO at the number available on the website uodo.gov.pl and verify the identity of a UODO employee. However, the Party did not contact the UODO; therefore, on June 5, 2026, the DKE employee sent another email to the Business Owner requesting contact, which remained unanswered. Due to the Party’s lack of response to the above emails, the DKE employee also attempted to contact the Party by phone. On June 10, 2026, two calls were made to the Business Owner’s contact number listed in the CEIDG, but the attempts to connect were unsuccessful because the number was unavailable. Another attempt was made on June 12, 2026, but the number remained unavailable on that occasion as well. The President of the Personal Data Protection Office (UODO) established the above facts based on official correspondence addressed to the Data Controller, contained in the case file bearing reference number DKN. 5101.8.2025.(…). This correspondence reflects the actions taken by the President of the Personal Data Protection Office (UODO) for the purpose of obtaining the information necessary to carry out his statutory duties and to review case no. DKN.5101.8.2025.(…), and at the same time serves as evidence of the Party’s failure to respond to the request addressed to it to provide supplementary explanations. The facts were also established on the basis of email correspondence addressed to the Party and a memo prepared by a DKE employee regarding an attempt to contact the Controller by telephone. These documents confirm that the UODO made unsuccessful attempts to contact the Party using the available communication channels, and at the same time demonstrate the Party’s failure to respond to the requests addressed to it. II. Proceedings Due to the Controller’s failure to provide the information necessary to resolve case no. DKN.5101.8.2025.(…), the President of the UODO initiated ex officio—pursuant to Article 83(5)(e) of Regulation 2016/679—the present administrative proceeding, case no. DKE.561.7.2026.(…) regarding the imposition of an administrative fine on the Business for violating Article 58(1)(a) and (e) of Regulation 2016/679. The Party was notified of the initiation of the proceedings by Decision DKE.561.7.2026 The website5 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. on June 15, 2026. In that letter, the Business was informed of the nature of the violation and advised of the sanctions it could face. The Data Controller was also requested, for the purpose of determining the basis for calculating the administrative fine pursuant to Article 101a(1) of the Personal Data Protection Act, to submit financial statements, a tax return, or any other document showing the amount of revenue (turnover) generated in 2025. The letter indicated that failure to submit such a document or information would result in the President of the Personal Data Protection Office (UODO) determining the basis for calculating the penalty on an estimated basis, in accordance with Art. 101a(2) of the Personal Data Protection Act. At the same time, the Party was informed of the continuing opportunity to submit the explanations requested by the President of the Personal Data Protection Office in proceeding No. DKN.5101.8.2025.(…), which could mitigate the amount of the administrative fine imposed in this case or result in a waiver of the fine. This letter, after two notices of delivery on June 19, 2026, and June 29, 2026, was returned to the UODO with thethe notation “RETURNED—not accepted within the time limit”; however, pursuant to Art. 44, § 1 and 4 of the Code of Administrative Procedure, it must be deemed to have been properly served on the Business Owner as of July 3, 2026. The notice of the initiation of these proceedings did not elicit any response from the Controller—the Business did not submit any additional explanations regarding case no. DKN.5101.8.2025.(…), nor did it provide the data necessary to determine the basis for calculating the administrative fine in these proceedings. After reviewing all the evidence gathered in the case, the President of the Personal Data Protection Office (UODO) concluded as follows. III. Legal Basis Pursuant to Article 57(1)(a) of Regulation 2016/679, the President of the UODO—as a supervisory authority within the meaning of Article 51 of Regulation 2016/679—monitors and enforces the application of that Regulation within its territory. Within the scope of his or her powers, the President of the UODO, among other things, conducts proceedings regarding the application of Regulation 2016/679, including on the basis of information received from another supervisory authority or another public authority (Art. 57(1)(h) of Regulation 2016/679). Pursuant to Article 60 of the Personal Data Protection Act, proceedings concerning data breaches are conducted by the President of the UODO. In turn, Art. 7(1) of the Personal Data Protection Act provides that in matters not regulated by this Act, the provisions of Chapter 11 of the Act on Personal Data Protection are to be applied to administrative proceedings before the President of the Office for Data Protection (including of the Code of Administrative Procedure shall apply. Pursuant to Article 7(2) of the Personal Data Protection Act, these proceedings are single-instance proceedings. Decision DKE.561.7.2026 The website6 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. To enable the supervisory authority to carry out its tasks, the President of the Personal Data Protection Office (UODO) is vested with a range of powers specified in Article 58(1) of Regulation 2016/679 with respect to the proceedings conducted, including the power to order the controller and the processor to provide all information necessary for the performance of its tasks (Article 58(1)(a) of Regulation 2016/679) and the power to obtain from the controller and the processor access to all personal data and information necessary for the performance of its tasks (Article 58(1)(e) of Regulation 2016/679). A violation of the provisions of Regulation 2016/679 consisting of the controller or processor’s failure to provide access to personal data and information, resulting in a violation of the authority’s rights set forth in Article 58(1) of that legal act, is subject— pursuant to Article 83(5)(e) in fine of Regulation 2016/679—to an administrative fine of up to 20,000,000 euros, and in the case of an undertaking, up to 4% of its total worldwide annual turnover from the preceding fiscal year, whichever is higher. When assessing whether, and if so, to what extent an administrative fine should be imposed, the supervisory authority is required to take into account the following circumstances (factors for determining the fine) set forth in Article 83(2) of Regulation 2016/679: a) the nature, gravity, and duration of the infringement, taking into account the nature, scope, or processing purpose in question, the number of data subjects affected, and the extent of the damage suffered by them; b) whether the infringement was intentional or unintentional; c) the measures taken by the controller or processor to minimize the damage suffered by the data subjects; d) the degree of responsibility of the controller or processor, taking into account the technical and organizational measures implemented by them pursuant to Articles 25 and 32; e) any relevant prior breaches by the controller or processor; f) the extent of cooperation with the supervisory authority for the purpose of erasing the breach and mitigating its potential adverse effects; g) the categories of data affected by the breach; h) how the supervisory authority became aware of the breach, in particular whether and to what extent the controller or processor reported the breach; i) if measures referred to in Article 58(2) have previously been imposed on the controller or processor concerned in the same case—compliance with those measures; j) the application of approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42; k) Decision DKE.561.7.2026 The website7 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial gains achieved directly or indirectly in connection with the violation or losses avoided. Furthermore, in accordance with Article 83(1) of Regulation 2016/679, the supervisory authority shall ensure that the administrative fines imposed are, in each individual case, effective, proportionate, and dissuasive. The purpose of determining the basis for calculating the administrative fine is for the entity subject to the proceedings to, upon request by the President of the Personal Data Protection Office (UODO), provide the necessary data for determining said basis within 30 days of the date of service of the request (Article 101a(1) of the Personal Data Protection Act). However, if the entity subject to the penalty fails to provide this data, the President of the Personal Data Protection Office (UODO) determines the basis for calculating the administrativeadministrative fine on an estimated basis, taking into account the size of the entity, the specific nature of its business, or publicly available financial data concerning the entity (Art. 101a(2) of the Personal Data Protection Act). Pursuant to Article 103 of the Personal Data Protection Act, the equivalent of the amounts expressed in euros referred to in Article 83 of Regulation 2016/679 shall be calculated in zlotys based on the average euro exchange rate published by the National Bank of Poland in its exchange rate table as of January 28 of each year; if, in a given year, the National Bank of Poland does not publish the average euro exchange rate on January 28, the calculation shall be based on the average euro exchange rate published in the National Bank of Poland’s exchange rate table closest to that date. Pursuant to Art. 42 § 1 of the Code of Administrative Procedure, documents are served on individuals at their residence or place of work, or at the mailing address indicated in the electronic address database. Article 44 of the Code of Administrative Procedure provides that if it is impossible to serve a document in the manner specified in Articles 42 and 43 of the Code of Administrative Procedure, the postal operator, as defined in the Act of November 23, 2012, The Postal Law shall perform storage of the document for a period of 14 days at its postal facility—in the case of delivery by a postal operator (§ 1(1)). A notice of the document’s deposit, along with information regarding the possibility of its pickup within seven days from the date the notice was left at the location specified in § 1—is placed in the recipient’s mailbox or, if this is not possible, on the door of the recipient’s residence, office, or other premises where the recipient conducts business, or in a visible location at the entrance to the recipient’s property (§ 2). If the item is not collected within this period, a second notice is left informing the addressee that the item may be collected within a period not exceeding fourteen days from the date of the first notice (§ 3). Service is deemed to have been effected upon the expiration of 14 days from the date of the first attempt at service, and the document is placed on the case file (§ 4). Decision DKE.561.7.2026 The website8 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. IV. Legal Assessment Applying the above-mentioned legal provisions to the facts established in this case, it must first be considered whether the Business Owner is subject to the obligations referred to in Art. 58(1)(a) and (e) of Regulation 2016/679, the violation of which is subject to an administrative fine pursuant to Art. 83(5)(e) of Regulation 2016/679. The aforementioned provisions of Regulation 2016/679 impose a procedural obligation—within the framework of proceedings conducted by the President of the Personal Data Protection Office (UODO)—on controllers and processors. The case file DKN.5101.8.2025.(…) indicates that irregularities in the processing of data concerning individuals (…) and individuals (…) may have occurred in connection with the operation of the websites (…) and (…). As indicated in point 3 of the reasoning, the Business Operator confirmed in a letter dated February 26, 2025, that as of the date of that letter, it was the controller of the personal data processed through the website (…). Therefore, the President of the Personal Data Protection Office is authorized— pursuant to Art.—to take the necessary measures to protect the personal data 58(1)(a) and (e) of Regulation 2016/679—to order the Party to provide the information necessary to verify reports indicating a possible violation of the provisions of Regulation 2016/679, while the Business Operator—on the same legal basis—is obligated to provide such information. The Party initially actively participated in the proceedings under file no. DKN.5101.8.2025. (…) by responding to the requests of the President of the Personal Data Protection Office (UODO) in letters dated February 26, May 2, and December 5, 2025. Since the explanations provided by the Business turned out to be insufficient to resolve the concerns raised with the supervisory authority, the President of the UODO issued a request to the Party on March 20, 2026, asking for additional explanations. However, this letter was notified only once and was subsequently returned to the UODO. Due to errors in the delivery of the letter dated March 20, 2026, the authority issued another request to the Party on April 15, 2026. Despite having been properly served twice, this request was not acknowledged within the prescribed time limit; therefore, it had to be deemed served on the Business under the substitute service procedure referred to in Art. 44 of the Code of Administrative Procedure. At this point, it should be noted that, according to the entry in the CEIDG, the Party is an entity actively conducting business activities whose purpose is (…). The address for service, as indicated in the CEIDG both at the time of registration and at the time of renewal, is (…). the first letter from the President of the Personal Data Protection Office (UODO) regarding case no. DKN.5101.8.2025. (…) (i.e., the letter dated February 3, 2025, which was effectively served—see point 2 of the reasoning), as well as the request to supplement the explanations dated April 15, 2026, (see point 6 of the reasoning), as well as the letter dated June 15, 2026, notifying the Entrepreneur of the initiation of these proceedings (see point 11 of the reasoning), the address “ul. (…), (…)-(…) Z.” remained in effect. This address is also the current address for service as of the date of issuance of Decision DKE.561.7.2026 The website9 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. this decision. Furthermore, the Party does not have an address for electronic service of process, nor has it specified a permanent place of business. It therefore remains entirely unclear why the Entrepreneur ignored the request from the President of the Personal Data Protection Office (UODO) to submit additional explanations in case no. DKN. 5101.8.2025.(…). The Party is obligated to fulfill all duties prescribed by law, including those arising from data protection regulations, which apply to it by virtue of the role it plays with respect to the processed personal data, i.e., the role of controller. Thus, the Business was (and remains) obligated, pursuant to Article 58(1)(a) and (e) of Regulation 2016/679, to respond to the request from the President of the Personal Data Protection Office (UODO). It should be noted that the supervisory authority did not limit itself to sending the Business a written request for supplementary explanations, but also took steps with the purpose of contacting the Party using alternative methods. First, the business was sent an email requesting that it contact the Office in connection with the ongoing investigation, case no. DKN.5101.8.2025. (…) - However, the Party did not respond to the request for additional explanations and did not contact the UODO. The Entrepreneur’s passive attitude was not altered even by attempts to contact them by phone—the contact number listed in the CEIDG turned out to be inactive. The circumstances indicated above support the conclusion that the business owner objectively had the opportunity to familiarize himself with the content of the letter sent to him by the supervisory authority, and the fact that he did not receive it—resulting in his failure to provide the explanations requested by the authority—is solely his own fault. In the opinion of the President of the Personal Data Protection Office (UODO), the business’s passive attitude demonstrates its dismissive attitude toward both the authority and the proceedings conducted by that authority. Despite the exhaustion of all means to obtain the information necessary for a comprehensive clarification of case no. DKN.5101.8.2025.(…)—which information remains at the Entrepreneur’s disposal—the Entrepreneur had not cooperated with the supervisory authority as of the date of issuance of this administrative decision. The failure to submit the additional explanations requested by the President of the Personal Data Protection Office (UODO) from the Party in a letter dated April 15, 2026, constitutes an obstacle to an objective, thorough, and comprehensive examination of case no. DKN.5101.8.2025.(…). In light of the foregoing, it must be concluded that the conditions justifying the imposition on the Business—pursuant to Article 83(5)(e) of Regulation 2016/679 —an administrative fine for violating the provisions of Article 58(1)(a) and (e) of that Regulation, consisting of a failure to provide access to all personal data and information necessary for the President of the Personal Data Protection Office (UODO) to perform his duties in the proceedings under case no. DKN. 5101.8.2025.(…). The lack of access to information prevents the supervisory authority from resolving the case with reference number DKN.5101.8.2025.(…) and results in an unjustified prolongation of the duration of this investigative proceeding. Furthermore, this constitutes a violation of the rights of the individuals affected by the irregularities referred to in Decision DKE.561.7.2026 The website10 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. point 1 of the statement of reasons, to effective and prompt legal protection from the supervisory authority. V. Grounds for Imposing an Administrative Fine Pursuant to Article 83(2) of Regulation 2016/679, an administrative fine is imposed depending on the circumstances of each individual case. In deciding to impose an administrative fine on the Business, the President of the Personal Data Protection Office (UODO)—in accordance with Article 83(2)(a)–(k) of Regulation 2016/679 — took into account the following circumstances of the case, which demonstrate the necessity of applying this type of sanction in the present case and which weigh against the amount of the administrative fine imposed. The nature, gravity, and duration of the infringement (Art. 83(2)(a) of Regulation 2016/679). The violation subject to an administrative fine in this case undermines the system with the purpose of protecting one of the fundamental rights of natural persons, namely the right to the protection of their personal data, or, more broadly, the right to privacy. An essential element of this system, the framework of which is defined by the provisions of Regulation 2016/679, are the supervisory authorities, which have been entrusted with tasks related to the protection and enforcement of natural persons’ rights in this regard. To achieve the purpose of fulfilling these tasks, supervisory authorities have been granted a range of supervisory powers, powers to conduct administrative proceedings, and remedial powers. Conversely, controllers and processors have been subject to specific obligations that correspond to the powers of the supervisory authorities, including the obligation to provide these authorities with access to the personal data and information necessary for the performance of their tasks. The EU legislator itself emphasized the seriousness of breaching these obligations by providing for a penalty for such breaches that is the higher of the two amounts specified in Regulation 2016/679 —up to 20,000,000 euros, or, in the case of an enterprise, up to 4% of its total annual global turnover from the previous fiscal year, whichever is higher. The Entrepreneur’s conduct examined in this case—consisting of denying access to the information and personal data requested by the President of the Personal Data Protection Office (UODO)—must be considered detrimental to the entire personal data protection system and, therefore, of significant gravity and a reprehensible nature. The gravity of the violation is further exacerbated by the fact that the Entrepreneur’s established failure is of a continuous nature and has persisted since the expiration of the 3-day deadline for submitting explanations, set forth in the summons dated April 15, 2026, addressed to Decision DKE.561.7.2026 The website11 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. the Business in the proceedings under file no. DKN.5101.8.2025.(…), that is, from May 9, 2026, until the date of issuance of the administrative decision concluding these proceedings—and thus, as of the date of issuance of this decision, nearly 4 months. Taking into account all of the circumstances set forth above, the authority assessed the criterion set forth in Art. 83(2)(a) of Regulation 2016/679, considered as a whole, as aggravating. Intentional nature of the violation (Article 83(2)(b) of Regulation 2016/679). In analyzing the criterion set forth in Article 83(2)(b) of Regulation 2016/679, the President of the Personal Data Protection Office (UODO) took into account the position expressed by the European Data Protection Board (EDPB), according to which intent “encompasses both knowledge and deliberate action in connection with the characteristics of the prohibited act” (see paragraph 55 of Guidelines 04/2022). In the opinion of the President of the Personal Data Protection Office (UODO), the business operator knowingly and intentionally failed to provide the supervisory authority with access to the information necessary to resolve the matter requested by the President of the UODO. The business operator was aware of the ongoing investigative proceedings before the supervisory authority, case no. DKN.5101.8.2025.(…)—he received letters from the President of the UODO dated February 3, April 9, and November 6, 2025, and responded to them on February 26, May 2, and December 5, 2025, respectively. The business was also aware that the supervisory authority was attempting to contact it in connection with the ongoing investigation —as evidenced by the successful delivery to him of an email dated May 15, 2026, in which he was asked to contact the Office regarding case no. DKN.5101.8.2025.(…) (see point 8 of the reasoning). The President of the Personal Data Protection Office (UODO) assesses the failure to respond to the correspondence addressed to the Business Entity on April 15, 2026, as a deliberate omission, the effect of which is to hinder or even prevent the supervisory authority from assessing the reported objections concerning irregularities in connection with the operation of the websites (…) and (…). This circumstance should be viewed negatively and considered an aggravating factor in determining both the justification for imposing the fine and the amount of the fine imposed. Any relevant prior violations by the controller (Art 83(2)(e) of Regulation) 2016/679). In deciding on the imposition and the amount of the administrative fine imposed on the Business, the President of the Personal Data Protection Office (UODO) considered as an aggravating circumstance the fact that the Business had previously Decision DKE.561.7.2026 The website12 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. by the Party of the provisions of Regulation 2016/679. The supervisory authority had previously issued the following decisions against the Company, pursuant to which it issued a warning or ordered the Company to bring its personal data processing operations into compliance with the provisions of Regulation 2016/679: a) the decision of the President of the Personal Data Protection Office (UODO) dated May 11, 2026, in case no. DS.523.380.2025, pursuant to which the President of UODO, in point 1, ordered the Company to carry out the erasure of the complainant’s personal data that had been processed without a legal basis, and in point 2 issued a warning to the Business for violating Article 6(1) of Regulation 2016/679 by making the complainant’s personal data available without a legal basis on the https:// website (…); b) the decision of the President of the Personal Data Protection Office (UODO) dated May 20, 2026, in case no. DWKSN.523.7006.2025, pursuant to which the President of UODO ordered the Company to carry out the erasure of the complainant’s personal data processed without a legal basis on the https:// website (…). It should be noted here that, according to the EDPB’s position, “[t]he occurrence of of prior violations may be considered an aggravating circumstance when calculating a financial penalty. The weight assigned to this factor should be determined by taking into account the nature and frequency of the prior violations. However, the absence of prior violations cannot be considered a mitigating circumstance, as compliance with the provisions of [Regulation 2016/679] is the norm” (see paragraph 94 of Guidelines 04/2022). In light of the foregoing, it should be noted that the violation at issue in this proceeding is not substantively identical to the violations found in the decisions cited in paragraph 33 of the reasoning. The subject matter of this case is, in fact, the controller’s improper fulfillment of its obligations toward the supervisory authority, consisting of failing to provide the President of the Personal Data Protection Office (UODO) with access to personal data and information necessary for the performance of his duties. The decisions issued against the Business referred to in paragraph 33 of the reasoning, however, concerned violations consisting of the unjustified processing of the complainants’ personal data. However, taking into account the position of the EDPB, according to which “all prior violations may provide insight into the general approach of the controller or to comply with the provisions of the GDPR” (see paragraph 88 of Guidelines 04/2022), the President of the Personal Data Protection Office (UODO) considered the Business’s prior violations—which indicate existing difficulties in ensuring that its operations comply with data protection regulations—to be to its detriment. At the same time, however, the lack of a direct link between the decisions cited in paragraph 33 of the reasoning—issued in proceedings initiated as a result of complaints by data subjects—and the violation that is the subject of the present proceedings indicates that the analyzed factor had only a limited impact on the amount of the penalty imposed. Decision DKE.561.7.2026 The website13 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. The degree of cooperation with the supervisory authority to remedy the violation and mitigate its potential negative effects (Articles 83(2)(f) and 83(para 2)(f) of Regulation 2016/679). In the course of these proceedings concerning the imposition of an administrative fine on the Business Entity, as well as in the course of the proceedings under file no. DKN.5101.8.2025.(…), the Business Entity failed to cooperate with the supervisory authority to achieve the erasure of the violation consisting of a failure to provide access to the personal data and information necessary for the President of the Personal Data Protection Office (UODO) to perform his duties. The party did not submit supplementary explanations and, consequently, did not provide the information requested by the President of the Personal Data Protection Office (UODO), which could have been regarded as a purpose to achieve erasure of the violation identified in this case or to mitigate its effects. This lack of cooperation resulted in the obstruction and unjustified prolongation of the investigative proceedings conducted by the President of the Personal Data Protection Office (UODO), case no. DKN.5101.8.2025.(…). The Controller’s continued state of non-compliance (lack of willingness to restore compliance with the law by fulfilling its procedural obligations in the proceedings before the President of the UODO) has, in the opinion of the President of the UODO, an aggravating effect on the assessment of the established violation. As a side note, it should be pointed out that for the assessment of the condition specified in Article 83(2)(f) of Regulation 2016/679, the fact that the Party, in its letters dated February 26, May 2, and December 5, 2025, responded to earlier requests from the President of the UODO regarding case no. DKN.5101.8.2025.(…). These explanations were, in fact, submitted prior to the commission of the violation that is the subject of the present proceedings and, therefore, cannot be considered an act of cooperation with the supervisory authority with the purpose of erasing the violation or mitigating its potential negative consequences. At the same time, according to the EDPB’s position, “(…) the general obligation to cooperate is mandatory and, therefore, should be considered a neutral (rather than a mitigating) factor” (see paragraph 96 of Guidelines 04/2022). In the opinion of the President of the Personal Data Protection Office (UODO), none of the circumstances referred to in Art. 83(2) of Regulation 2016/679 justify mitigating the penalty imposed by this administrative decision, which was determined taking into account the aggravating circumstances indicated above. Circumstances other than those listed below, as referred to in Article 83(2) of Regulation 2016/679, after assessing their impact on the violation established in this case, were deemed by the President of the Personal Data Protection Office (UODO) to be neutral—that is, having neither an aggravating nor a mitigating effect on the amount of the administrative fine imposed: Decision DKE.561.7.2026 The website14 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. a) the manner in which the supervisory authority became aware of the violation, in particular, whether and to what extent the controller reported the violation (Articles 83(2)(h) and 83(2)(i) of Regulation 2016/679) - The President of the Personal Data Protection Office (UODO) obtained information about the breach established in this case ex officio by analyzing the course of the proceedings pending before him, case no. DKN.5101.8.2025.(…). This is a natural way of obtaining information about this type of breach, stemming from the President of the Personal Data Protection Office’s authority to assess the course of these proceedings and determine what information is necessary for him to resolve the case at hand. There are therefore no grounds for a negative assessment of the fact that the information about the violation did not come from the Business. However, this fact cannot be taken into account in favor of the Business, since it played no role in the UODO President’s acquisition of information about the violation; b) if measures referred to in Article 58(2) have previously been imposed on the controller concerned in the same case—compliance with those measures (Article 83(2)(i) of Regulation 2016/679) - prior to issuing this decision, the President of the Personal Data Protection Office (UODO) did not impose on the Business Operator, in the case at hand, any of the measures listed in Art. 58(2) of Regulation 2016/679, and therefore the Business Operator was under no obligation to take any actions related to their application, which, if assessed by the President of the Personal Data Protection Office, could have had an aggravating or mitigating effect on the assessment of the established violation; c) the use of approved codes of conduct pursuant to Article 40 or approved certification mechanisms pursuant to Article 42 (Article 83(2)(j) of Regulation 2016/679) - The business does not apply the approved codes of conduct or approved certification mechanisms referred to in the provisions of Regulation 2016/679. However, as provided by Regulation 2016/679, the adoption, implementation, and application of the above measures are not mandatory for the controller. This means that the fact that they are not applied cannot be held against the controller. The situation would be different if the business had adopted and applied a measure of this kind that guarantees a higher-thanstandard level of data protection for the personal data being processed. In such a case, this circumstance could be assessed in its favor; d) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained directly or indirectly in connection with the violation or losses avoided (Art. 83(2)(k) of Regulation 2016/679) - The President of the Personal Data Protection Office (UODO), having comprehensively reviewed the case, did not identify any circumstances other than those described above that could influence the assessment of the violation or the amount of the administrative fine imposed. In particular, the supervisory authority did not find that the Business, by failing to provide the requested information, derived any financial benefits or avoided any such losses. There are therefore no grounds for treating this circumstance as an aggravating factor. A finding that there were measurable financial benefits resulting from the violation of the provisions of Regulation 2016/679 would have to be assessed very negatively. On the other hand, the fact that the business operator did not achieve such benefits—as a natural state of affairs independent of its will and actions—is a circumstance that, by its very nature, cannot Decision DKE.561.7.2026 The website15 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. constitute a mitigating factor for the business. This is confirmed by the very wording of Article 83(2)(k) of Regulation 2016/679, which requires the supervisory authority to take due account of the benefits “realized”—those accruing to the entity committing the infringement. The other circumstances listed in Article 83(2) of Regulation 2016/679 could not be taken into account by the President of the Personal Data Protection Office (UODO) due to the nature of the violation (which concerned the controller’s relationship with the supervisory authority, rather than with the data subjects). These are: a) the number of individuals affected and the extent of the harm suffered by them (Art. 83(2)(a) of Regulation 2016/679) - given that the violation (the business’s failure to provide the President of the Personal Data Protection Office with access to the necessary information) does not involve a breach of any individual’s personal data, it cannot be concluded that natural persons suffered any harm in this case; b) measures taken by the controller to minimize the damage suffered by data subjects (Article 83(2)(c) of Regulation 2016/679) - since it cannot be established in this case that any harm was caused to natural persons, the Business has neither the obligation nor the possibility to take any measures with the purpose of minimizing such harm; c) the degree of the controller’s liability, taking into account the technical and organizational measures implemented by the controller pursuant to Articles 25 and 32 of Regulation 2016/679 (Article 83(2)(d) of Regulation 2016/679)—given that the breach, by its very nature, is not related to the technical and organizational measures implemented by the Company to achieve data protection and the security of its processing; d) the categories of personal data affected by the breach (Art. 83(2)(g) of Regulation 2016/679) - because the breach, consisting of a failure to provide information and to grant access to the personal data and information necessary for the President of the Personal Data Protection Office (UODO) to perform his duties, does not involve any personal data. VI. Determination of the Amount of the Administrative Fine In determining the amount of the administrative fine imposed on the Party, the President of the Personal Data Protection Office took into account the fact that the Business Entity does not belong to the group of entities listed in Article 102(1) and (2) of the Personal Data Protection Act, and therefore, in this case, the limits on the amount of the fine—PLN 10,000 or PLN 100,000, respectively—do not apply. Consequently, pursuant to Article 101 of the Personal Data Protection Act, the administrative fine was imposed on the basis of and under the conditions set forth in Article 83 of Regulation 2016/679. Decision DKE.561.7.2026 The website16 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. To ensure a consistent approach to the application and enforcement of Regulation 2016/679, the European Data Protection Board adopted Guidelines 04/2022 on the calculation of administrative fines under the GDPR [4] (hereinafter: “Guidelines 04/2022”). According to Guidelines 04/2022, the starting point for the calculation is to consider three elements: the categorization of infringements based on their nature in accordance with Art. 83 para 4–6 of Regulation 2016/679, the gravity of the infringement, and the enterprise’s turnover, which constitutes one of the relevant factors to be taken into account in calculating the amount of the administrative fine. Due to the Party’s failure to provide information on the amount of revenue generated in the year preceding the issuance of this decision, the supervisory authority relied on the methodology set forth in Guidelines 04/2022 only in a supplementary and limited manner, and in determining the amount of the administrative fine, it relied on the general principles for determining the amount of the fine set forth in Art. 83(1) of Regulation 2016/679. Pursuant to the aforementioned provision, it is the supervisory authority’s task to ensure that the administrative fines imposed are, in each individual case, effective, proportionate, and dissuasive. A sanction can be considered effective when it achieves the purpose for which it was imposed. A sanction is proportionate when it does not exceed the threshold of severity determined by taking into account the circumstances of the specific case. A sanction is deterrent if it serves the purposes of individual and general prevention—in other words, it sends a clear signal of disapproval of the violation to society, as well as to the recipient of the sanction [5] . Bearing in mind the above-mentioned principles for determining the amount of administrative fines imposed for violations of Regulation 2016/679, when determining the amount of the fine to be imposed on the Business, the President of the Personal Data Protection Office (UODO) was required to take into account, on the one hand, the gravity of the violation and all aggravating and mitigating circumstances present in this specific case, and, on the other hand, the financial capacity and specific circumstances of the entity being penalized. Applying the above to the present case, it is worth noting first of all that the infringement of Regulation 2016/679 under consideration should (pursuant to Article 83 para 2). 5(e) of Regulation 2016/679) falls into the category of violations punishable by the higher of the two penalty ranges provided for in that legal act, with a maximum amount of up to 20,000,000 EUR or up to 4% of the enterprise’s turnover from the previous fiscal year — it is therefore, in abstracto, the “most serious” of the violations provided for in Regulation 2016/679. Furthermore, the individual circumstances of this specific case support the conclusion that the violation committed by the Business Operator should be assessed as being of significant gravity (“gravity” as defined in Chapter 4.2 of Guidelines 04/2022). As part of this assessment, consideration was given to those factors listed in Article 83(2) of Regulation 2016/679 that pertain to the infringement in question (and constitute the “gravity” of the infringement), namely: the nature, severity, and duration of the breach (Article 83(2)(a) of Regulation 2016/679) and the intentional nature Decision DKE.561.7.2026 The website17 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. of the breach (Art. 83(2)(b) of Regulation 2016/679). The factors relating to the number of affected individuals and the extent of the damage they suffered (Art. 83(2)(a) of Regulation 2016/679), as well as the categories of personal data affected by the infringement (Article 83(2)(g) of Regulation 2016/679) were not taken into account due to the nature of the infringement. A detailed assessment of these circumstances is set forth above (see paragraphs 29–32 and 40 of the reasoning). Considering their combined impact on the assessment of the violation established in this case, viewed as a whole, leads to the conclusion that the level of its seriousness is significant—justifying the imposition of an administrative fine on the perpetrator. As indicated in paragraph 43 of the reasoning, when determining the amount of the fine, the supervisory authority also took into account the other circumstances (in addition to those considered in the assessment of the seriousness of the violation) specified in Art. 83(2) of Regulation 2016/679. A detailed analysis and justification of the impact of each of these circumstances on the assessment of the violation are presented above (see points 33–40 of the reasoning). The President of the Personal Data Protection Office (UODO) determined that the aggravating circumstances in this case are the grounds provided for in Art. 83(2)(e) and (f) of Regulation 2016/679, i.e., any relevant prior infringements by the controller and the degree of cooperation with the supervisory authority for the erasure of the infringement and to mitigate its potential negative effects (see paragraphs 33–37 of the reasoning). The other factors set forth in Article 83(2) of Regulation 2016/679 had neither a mitigating nor an aggravating effect on the assessment of the infringement and, consequently, on the amount of the administrative fine. In determining the amount of the administrative fine, the President of the Personal Data Protection Office (UODO) also took into account the financial capacity of the penalized entity. Despite a request from the supervisory authority, the business failed to provide information on its revenue for 2025. It is also not possible to obtain such information from publicly available sources. In view of this, the President of the Personal Data Protection Office (UODO), in accordance with Art. 101a(2) of the Personal Data Protection Act, took into account the size of the entity as well as the nature, scope, and scale of its business activities. As indicated in point 24 of the explanatory memorandum, the entrepreneur is listed in the Central Register and Information System on Business Activity as an entity actively conducting business activities whose purpose is (…). The party also has a profile on the website (…)[6] under the name D. (the former name of the Entrepreneur’s sole proprietorship ), on which the size of the business is specified as “2–10 employees.” Thus, the supervisory authority concluded that the fact that the Party is actively conducting business activities involving the provision of services (…) provides grounds for concluding that the Entrepreneur has the financial means to pay the administrative fine. However, based on publicly available information, the scale of the business conducted by the Entrepreneur should be assessed as small. In light of the foregoing, the President of the Personal Data Protection Office (UODO) determined that an appropriate and justified measurein this case an administrative fine of 7,500 euros for the business’s violation of Article 58(1)(a) and (e) of Regulation 2016/679, which—after conversion in accordance with the average euro exchange rate as of January 28, Decision DKE.561.7.2026 The website18 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. 2026, where 1 EUR = 4.2009 PLN—the equivalent of 31,507 PLN (in words: thirty-one thousand five hundred and seven zlotys). An administrative fine in the amount of 31,507 PLN, imposed in these specific,circumstances of the case, will be effective because it will lead—in the assessment of the President of the Personal Data Protection Office (UODO)—to a situation in which the Business will, in the future, fulfill its obligations regarding data protection, particularly with regard to cooperation with the supervisory authority and ensuring that the President of the UODO has access to the personal data and information necessary for the performance of his duties. It can be expected that, as a result of the imposition of an administrative fine, the Business will approach the requirements set forth in data protection regulations with due diligence. The administrative fine imposed on the Company will also be proportionate to the established violation of Article 58(1)(a) and (e) of Regulation 2016/679, as it has been set at a level that, on the one hand, constitutes an adequate response by the supervisory authority to the severity of the Company’s breach of its obligations, without, at the same time, causing significant harm to its business operations. Furthermore, this penalty will serve as a deterrent—it will send a clear signal to the Companyand to other controllers obligated under the provisions of Regulation 2016/679 to cooperate with the President of the Personal Data Protection Office (UODO) that disregarding the obligations related to such cooperation (in particular, obstructing access to personal data and information necessary for the performance of the President’s duties) constitutes a serious violation and, as such, will be subject to financial sanctions. It should be emphasized here that, in the circumstances of this specific case, the supervisory authority determined that imposing an administrative fine on the Party was necessary and justified, and that the application of any other corrective measure provided for in Art. 58(2) of Regulation 2016/679, in particular limiting the measure to a warning (Art. 58(2)(b) of Regulation 2016/679), would not be proportionate to the established violation. The President of the Personal Data Protection Office (UODO) took into account that, in accordance with Recital 148 of Regulation 2016/679, a reprimand may be imposed instead of an administrative fine in the case of a minor infringement or where a fine would impose a disproportionate burden on a natural person. In accordance with the aforementioned Recital 148, “[t]he nature, gravity, and the duration of the infringement, whether the infringement was intentional, the measures taken to minimize the damage, the degree of liability, or any relevant prior violations, the manner in which the supervisory authority became aware of the violation, the infringement, on compliance with measures imposed on the controller or processor, on the application of codes of conduct, and on any other aggravating In the circumstances of this case, it cannot be concluded that the violation was minor within the meaning of Recital 148 of Regulation 2016/679. The analysis of the facts of the case presented above, as well as a detailed assessment of the criteria set forth in Article 83 Decision DKE.561.7.2026 The website19 from 19 https://uodo.neurodoc.pl/document/urn:ndoc:gov:pl:uodo:2026:dke_561_7/content September 29, 2026, 6:59 a.m. (2) Para 2 of Regulation 2016/679 demonstrates the serious nature of the violation. In particular, it should be noted that none of the circumstances referred to in Article 83(2) of Regulation 2016/679, which could have been taken into account in favor of the Business, were present. Thus, taking into account all the circumstances referred to in Recital 148 of Regulation 2016/679, the infringement in question cannot be considered minor, and, in the opinion of the President of the Personal Data Protection Office (UODO), imposing only a warning would not ensure an effective and deterrent response to the established infringement. At the same time, it must be assumed that the administrative fine imposed will not constitute a disproportionate burden on the Business, a circumstance which (in accordance with Recital 148 of Regulation 2016/679) must also be taken into account when imposing a fine on a natural person. The supervisory authority set the fine at 31,507 PLN (equivalent to 7,500 EUR), which, in the opinion of the President of the Personal Data Protection Office (UODO), will enable the business to bear the cost without jeopardizing the financial foundations of its existence and operations, while at the same time ensuring that all functions of the—repressive, preventive, and deterrent functions—referred to in Art. 83(1) of Regulation 2016/679. It should be noted, in passing, that the amount of the administrative fine imposed represents only 0.0375% of the maximum fine that the President of the Personal Data Protection Office (UODO) could have imposed on the Business, pursuant to Art. 83(5)(e) of Regulation 2016/679, for the violation established in this case. In view of the foregoing, the President of the Personal Data Protection Office (UODO), for the violations described in the operative part of this administrative decision, imposed an administrative fine of 7,500 euros on the Business, which is equivalent to 31,507 PLN (in words: thirty-one thousand five hundred and seven zlotys). In view of the foregoing, the President of the Personal Data Protection Office (UODO) ruled as stated in the operative part. [1] Journal of Laws of 2025, Section 1691. [2] Journal of Laws of 2019, Section 1781, as amended. [3] Official Journal of the European Union L 119 of May 4, 2016, p. 1, as amended. [4] Guidelines 04/2022 on the calculation of administrative fines under the GDPR. Version

Adopted on May 24, 2023, available online: https://www.edpb.europa.eu/system/files/documents/2024- 01/edpb_guidelines_042022_calculationofadministrativefines_pl_0.pdf [accessed August 27, 2026]. [5] P. Litwiński (ed.), Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 […]; Commentary on Art. 83 [in:] P. Litwiński (ed.) General Data Protection Regulation. Personal Data Protection Act. Selected Sector-Specific Regulations. Commentary [6] (…)