On 15 March 2019 the President of the Personal Data Protection Office (UODO) in Poland imposed the first fine in the amount of over PLN 943m for the failure to fulfil an information obligation.
The decision of the UODO’s President concerned the proceedings related to the activity of a company which processed the subjects’ data obtained from publicly available sources, inter alia from the Central Electronic Register and Information on Economic Activity, and processed the data for commercial purposes. The authority verified noncompliance with the information obligation in relation to natural persons conducting business activity – entrepreneurs who are currently conducting such activity or have suspended it, as well as entrepreneurs who conducted such activity in the past. The controller fulfilled the information obligation by providing the information required under Art. 14 (1) – (3) of the GDPR only in relation to the persons whose e-mail addresses it had at its disposal. In the case of the remaining persons the controller failed to comply with the information obligation – as it explained in the course of the proceedings – due to high operational costs. Therefore, it presented the information clause only on its website.
In the opinion of the President of the Personal Data Protection Office, such action was insufficient – while having the contact data to particular persons, the controller should have fulfilled the information obligation in relation to them, that is it should have informed them inter alia on: their data, the source of their data, the purpose and the period of the planned data processing, as well as the data subjects’ rights under the GDPR. Read more: The first fine imposed by the President of the Personal Data Protection Office
The decision of the President of the Personal Data Protection Office in the case is available on the beinsured.pl website via link.
