Enforcement · Polish National Personal Data Protection Office (UODO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Krajowa Szkoła Sądownictwa i Prokuratury: Insufficient technical and organisational measures to ensure information security

€22,200 Fine
Krajowa Szkoła Sądownictwa i Prokuratury
POLAND
Art. 5 GDPR Art. 25 GDPR Art. 28 GDPR Art. 32 GDPR
Data Breaches Integrity and Confidentiality Principle Security Professional Secrecy Processing Agreement Education Privacy by Design & Default Controllers
Feb 11, 2021 Source

How it connects

Related across sources

Guidance Guidelines 07/2020 on the concepts of controller and processor in the GDPR EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Case Law Supreme Court upholds €300,000 fine against INPS for GDPR violations in COVID bonus data Supreme Court Case Law VB v Natsionalna agentsia za prihodite CJEU Guidance Guidelines 05/2022 on the use of facial recognition technology in the area of law enforcement EDPB Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB

Full text

The Polish DPA (UODO) fined Krajowa Szkoła Sądownictwa i Prokuratury (National School of Justice and Prosecution) EUR 22,200. UODO launched an investigation against the controller after it reported a data breach on its training platform website. During a test migration to the new platform, the data of more than 50,000 individuals had been exposed on the Internet. Among other things, this included the names, user names, postal and e-mail addresses, telephone numbers, units and departments of the data subjects. UODO found that the controller had not taken adequate technical and organizational measures to ensure the confidentiality of the data processed. In addition, the contract that the controller had concluded with the company entrusted with the processing of the data did not comply with the legal requirements. For example, the contract did not contain information about which categories of data would be processed.

Industry: Public Sector and Education

Original document at the source www.uodo.gov.pl

Similar Content