First penalty for GDPR violation at PLN 1 million
15:14
The Office for Personal Data Protection imposed a fairly large penalty – PLN 1 million – for breaking the personal data protection act on a company that processes publicly available data of companies and sole proprietors. The decision issued on March 15 shows that a Warsaw company collecting internet-accessible data of persons conducting business activity created a database enabling verification of the credibility of these entities.
All entrepreneurs who gave their email address in official registers were informed by this company about the processing of their data. In the case of others, the company decided to use the exception to the law, where informing about the processing of data would require a disproportionately large effort compared to expected gains. The company will likely appeal to the decision.
