# Śląski Uniwersytet Medyczny (Medical University of Silesia): Insufficient fulfilment of data breach notification obligations

- Type: Enforcement
- Source: Polish National Personal Data Protection Office (UODO)
- Date: 2021-01-05
- Original: https://www.enforcementtracker.com/ETid-527
- Canonical: https://overview.legal/posts/46642
- Topics: Notification Obligation, Data Breaches, Article 19 GDPR - Notification of Rectification, Erasure or Restriction, Notified Body Reporting and Notification Obligations, Healthcare, Education, Personal Data, Public Authority, Public Sector, Processing Agreement

## Summary

The Polish DPA (UODO) imposed a fine of PLN 25,000 (EUR 5,500) on the Medical University of Silesia. In the course of exams held in the form of videoconferences at the end of May 2020, identification of students took place. Once the exam was completed, the recordings of the exams were available not only to the examinees, but also to other people with access to the system. In addition, any outsider could access the records of the examinations and the data of the examined students presented during

## Full text

The Polish DPA (UODO) imposed a fine of PLN 25,000 (EUR 5,500) on the Medical University of Silesia. In the course of exams held in the form of videoconferences at the end of May 2020, identification of students took place. Once the exam was completed, the recordings of the exams were available not only to the examinees, but also to other people with access to the system. In addition, any outsider could access the records of the examinations and the data of the examined students presented during identification via a direct link. The University failed to report the data breach to the DPA and notify the data subjects.

GDPR Articles: Art. 33 (1) GDPR, Art. 34 (1) GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/46642 · 2026-08-22