Administrative fine of EUR 24 000 imposed by the Polish Data Protection Authority on an insurance company for breach of Articles 35 and 83 of the GDPR

The National Centre for Personal Data Protection (NCPDP), for information and enforcement purposes, communicates about the administrative fine in the amount of EUR 24,000 imposed by the Polish Data Protection Authority (SA) on an insurance company for violation of Article 35 (Data Protection Impact Assessment) and 83 (General conditions for imposing administrative fines) of the GDPR.

The Polish SA has been informed that an unauthorised recipient has received a document confirming the granting of compensation in an email attachment. The e-mail from the insurance company contained personal data such as: name, surname, postal address, model and registration number of the car, policy number and the amount of compensation granted. The unauthorised recipient informed the insurance company that he had received an e-mail with an attachment containing another person’s personal data, but received no reply.

Following the investigations, the Polish SA decided to impose an administrative fine under Article 83(2)(a) of the GDPR, taking into account aggravating circumstances such as: the long duration of the breach, the intentional nature of the finding of a breach of data protection regulations in other ongoing proceedings against the company, the unsatisfactory level of cooperation with the Supervisory Authority.

At the same time, the Polish SA pointed out that the company is subject to specific obligations imposed by Article 35(1) of the Law of 11 September 2015 on insurance and reinsurance activities, according to which the insurance company and its employees, as well as persons and entities through which it carries out insurance operations, are obliged to keep the individual insurance contract secret. 

The NCPDP, as the national supervisory authority for personal data processing, emphasises the responsibility of personal data controllers to comply with the provisions of the legislative framework for personal data protection and to ensure that personal data processing operations comply with the legislation in force.