The President of the Personal Data Protection Office (UODO) has imposed a fine of PLN 15,000 on East Power company from Jelenia Góra for failing to provide the supervisory authority with access to personal data and other information necessary for the performance of its tasks.
The fined company provides employment services in Poland and Germany, and a complaint against its actions was lodged by a German citizen because it processed his personal data for marketing purposes. The complaint was lodged with the German data protection authority competent for Rhineland-Palatinate, but it was taken over for consideration by the President of the UODO, who was the so-called lead authority in this case, because the company is established in Poland.
Within the framework of this proceeding, the President of the UODO sent three requests to the company to submit explanations. Two of them (correctly served and received by the company) remained unanswered. The company replied to one of the requests, but its explanations were incomplete and contradictory. In the opinion of the President of the UODO, they were manifestly insufficient to establish the facts of the case. Due to such conduct of the company, the President of the Personal Data Protection Office considered that it intentionally impedes the course of proceedings or at least ignores its obligations related to cooperation with the supervisory authority. The President of the UODO therefore considered it necessary to initiate a separate proceedings for the imposition of an administrative fine on it.
It was only in response to the notice of initiation of the proceedings that the company provided more extensive explanations, but they were incomplete and required further investigation. Therefore, the President of the Personal Data Protection Office considered that the company does not want to cooperate with it and does not fulfil the obligation – provided for in the GDPR – to provide it with access to personal data and other information necessary for the performance of its tasks, in this case for handling a complaint lodged by a German citizen.
When issuing the decision to impose an administrative fine on East Power Sp. z o.o. and determining its amount, the President of the UODO took into account as aggravating circumstances, among others, the seriousness of the breach (undermining the proper functioning of the personal data protection system specified by the GDPR), the intentional nature of the breach and the unsatisfactory degree of cooperation of the controller with the President of UODO in order to remedy the breach and mitigate its consequences.
