Enforcement · Polish National Personal Data Protection Office (UODO) EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Głównego Geodetę Kraju: Insufficient fulfilment of data breach notification obligations

€12,450 Fine
Głównego Geodetę Kraju
POLAND
Art. 33 GDPR Art. 34 GDPR
Notification Obligation Data Breaches Article 19 GDPR - Notification of Rectification, Erasure or Restriction Notified Body Reporting and Notification Obligations Public Authority Education Public Sector Controllers
Jul 6, 2022 Source

How it connects

Related across sources

Guidance Guidelines 10/2020 on restrictions under Article 23 GDPR EDPB Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them EDPB Guidance EDPB Annual Report 2021 EDPB

Full text

The Polish DPA has imposed a fine of EUR 12,450 on the public cartography institute Głównego Geodetę Kraju. The institute had suffered a data breach in which numerous land register numbers were visible on the institute's website for more than 48 hours. The land register number allows a number of owners' data to be determined, including their first and last names, the names of their parents and the address of the property. The institute had failed to report the breach to the DPA, with the result that it learned of the incident through media reports. The institute also failed to inform the data subjects of the incident. For this reason, the DPA found that the controller violated Article 33 (1) GDPR and Article 34 (1) GDPR.

Industry: Public Sector and Education

Original document at the source www.uodo.gov.pl

Similar Content