Cybersecurity Policy Report, Polish DPA Fines Banks Over Breach Reporting Failures, (Apr 2, 2024)

By Tony Foley

The Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO), announced today that it had issued fines against a pair of banks based on the failure to properly disclose data breaches under the European Union’s General Data Protection Regulation (GDPR).

Santander Bank. In a news release announcing the sanctions, UODO said it learned about a data breach involving Santander Bank Polska SA from media reports, which reported that bank documents were found in a parcel abandoned in a housing estate after having been stolen by a courier company. The information included personal data such as names, dates of birth, bank account numbers, and other banking-specific personal data. Santander contended that it did not report the incident because the parcel was found by one identified person shortly after it was lost by the courier, no documents were missing, and the person who discovered them took them directly to the police and stated that he did not copy the documents.

In its decision, UODO found that, in the event of a data breach, the assessment of the risk of violating the rights of a natural person should be made from the perspective of the person at risk, not the interests of the controller. The lack of notification to persons affected by the breach in such a high-risk situation deprives them not only of their right to respond to the breach appropriately, but the opportunity to independently assess whether the breach may have caused serious consequences. The failure to report the breach also deprived the supervisory authority of the opportunity to respond appropriately to the breach, including analyzing whether the bank had implemented appropriate security measures prior to the breach. The fact that the data was made available only to one person was irrelevant because the fact remained that it was abandoned and found by a person, and there was no way to know whether other people had previously had access to the abandoned shipment.

UODO imposed a fine of 1.4 million zlotys ($351,000) against Santander Bank and ordered it to notify persons affected by the violation within three days of the date of its receipt of the UODO decision.

Toyota Bank. UODO also investigated an incident in which Toyota Bank Polska SA sent a person’s data to an unauthorized recipient resulting in a heightened risk of identity theft. In its decision, UODO noted that Toyota Bank waited a year and a half prior to disclosing the breach, in violation of the GDPR’s 72-hour requirement. In addition, UODO said it could not be sure whether, before returning the misdirected correspondence, the incorrect recipient had not made a copy or recorded the personal data in some fashion. Accordingly, UODO fined the bank 78,000 zlotys ($19,600).

News: LitigationEnforcement DataSecurity DataBreach DataPrivacy GDPR