Cybersecurity Policy Report, Rental Car Company’s Data Breach Fine Upheld in Poland, (Jul 30, 2025)
By Tony Foley
The Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO), announced last week that an administrative court had dismissed a complaint filed by a car rental company challenging UODO’s decision imposing sanctions in connection with security of the company’s data processing activities.
In January, UODO issued fines against Panek S.A. and a subcontractor after a reconstruction of Panek’s website resulted in the placement of files with data from Panek’s old service onto the new web page, where they were indexed by Google and made available to the public. UODO found that although Panek knew how the implementation of the changes to the IT system should proceed in accordance with commonly used practices, it failed to properly supervise the implementation (CPR, Jan. 7). The agency issued fines of 1.53 million zlotys ($409,000) against Panek and 20,073 zlotys ($5,368) against the subcontractor.
In a July 24 press release, UODO noted that Panek filed a complaint in the Provincial Administrative Court accusing UODO of violations of various administrative law provisions, as well as several infringements of the European Union’s General Data Protection Regulation (GDPR). The court dismissed the complaint, noting that the essence of the case was to examine whether Panek had provided technical and organizational measures to verify the subcontractor’s actions in terms of implementing appropriate data security measures and finding that the company failed to do so.
The court said risk management was the foundation of personal data protection activities, implying that monitoring the level of threats and ensuring accountability regarding the adequacy of security measures is a necessity, without which personal data cannot be secured. Such activities also cannot be carried out without the creation of permanent documentation, which helps identify and classify threats in the future. Regardless of the relationship between a data controller and a data processor, the controller (in this case, Panek) is responsible for conducting a thorough risk analysis, the court concluded.
News: InternationalLegislation LitigationEnforcement DataSecurity DataBreach GDPR DataPrivacy