# National Prosecutor's Office: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Polish National Personal Data Protection Office (UODO)
- Date: 2024-09-02
- Original: https://www.enforcementtracker.com/ETid-2446
- Canonical: https://overview.legal/posts/48561
- Topics: Data Breaches, Personal Data, Public Authority, Education, Controllers, Public Sector, Processing, Processing Agreement, Supervisory Authorities, Data Controller

## Summary

The Polish DPA has imposed a fine of EUR 19,800 on the National Prosecutor's Office. During a press conference, the public prosecutor's office disclosed an individual's personal data, such as their first and last name and special categories of data, without a valid legal basis. The DPA also found that the controller failed to report the data breach to the DPA and the data subject.

## Full text

The Polish DPA has imposed a fine of EUR 19,800 on the National Prosecutor's Office. During a press conference, the public prosecutor's office disclosed an individual's personal data, such as their first and last name and special categories of data, without a valid legal basis. The DPA also found that the controller failed to report the data breach to the DPA and the data subject.

GDPR Articles: Art. 6 (1) GDPR, Art. 9 (1) GDPR, Art. 33 (1) GDPR, Art. 34 (1) GDPR
Industry: Public Sector and Education

---
Generated by overview.legal · https://overview.legal/posts/48561 · 2026-08-22