The Personal Data Protection Office (UODO), stating that PNP SA with its registered office in Warsaw violated the provisions of the General Data Protection Regulation, imposed an administrative fine on the company in the amount of over PLN 22 000 (EUR 5 000).
The reason for the fine is the failure to cooperate with the supervisory authority and to provide access to all information necessary for the UODO to carry out its tasks.
In order to determine the facts of the case initiated by the complaint, the UODO requested the fined company three times to respond to the complaint and to provide explanations. None of the requests sent to the company – to the addresses disclosed in the Register of Entrepreneurs of the National Court Register as the company’s registered office addresses – was received by the company, despite being served twice. Therefore, the requests sent to the company were deemed delivered.
As a consequence of the company’s failure to respond to the correspondence addressed to it, the UODO did not obtain the information necessary to examine the case. The initiation of the proceedings to impose an administrative fine on the company did not change the situation either. The letter informing about the initiation of such proceedings was not received by the company either.
The decision emphasised that the company is liable for failing to provide the UODO with the information it requested. The fact that the requests submitted by the UODO to the company were not ultimately received by the company does not change this circumstance. Quoting the administrative courts’ rulings, it was indicated that the obligation of each organisational unit is to ensure the collection of letters in such a way that the flow of correspondence takes place continuously and undisturbed and only by authorised persons. Negligence in this respect is the responsibility of the organisational unit.
The obligation to cooperate with the supervisory authority is identical for the controller and the processor. This cooperation shall include the necessity to provide the supervisory authority – on its request – with any information in the controller’s or processor’s possession related to the proceedings caried out.
It should be concluded that the company, by failing to respond to the UODO’s requests, breached its obligation to provide the supervisory authority with access to information necessary to perform its tasks – in this case, to resolve the case on its merits.
In the opinion of the UODO, the imposed administrative fine will discipline the company to properly cooperate with the supervisory authority both in the further course of the proceedings concerning the examination of the complaint and in any other future proceedings with the participation of the company before the Office.
