Polish Postal Service: Lack of appointment of data protection officer

The Polish DPA has imposed a fine of EUR 232,379 on the Polish Postal Service. The controller appointed a person as DPO who also held a managerial position with authority over security and classified information protection issues. However, the controller failed to conduct an analysis to ensure the DPO's independence. Furthermore, the controller was unable to ensure that the DPO could fulfil their role without any conflicts of interest.

GDPR Articles: Art. 38 (3), (6) GDPR
Industry: Public Sector and Education