POLAND DPA: Insufficient technical and organisational measures to ensure information security

The Polish DPA has imposed a fine of EUR 4,700 on a subcontractor that was contracted to redesign the website of another company. This fine is linked to ETid-2491. Due to an error by an employee of the subcontractor, customer data (including first name, last name, email address, address, and encrypted passwords) was accidentally published on the website during the redesign process. The incident affected approximately 20,000 data subjects. During its investigation, the DPA found that the subcontractor had failed to implement and verify appropriate technical and organizational measures to protect personal data, which could have prevented such an incident.

GDPR Articles: Art. 28 (3) c), f) GDPR, Art. 32 (1) , (2) GDPR
Industry: Not assigned