The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine equivalent to 20 000 euros, applied to the Polish insurance company, Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A. The sanction was applied for violating the provisions of the General Data Protection Regulation.

In May 2020, the Personal Data Protection Office of Poland (UODO) received information from a third party about the personal data breach, which consisted in sending by e-mail an insurance policy by an insurance agent, being a processor for the WARTA S.A. Insurance and Reinsurance Company, to an unauthorized addressee.

The attached document contained personal data as: names, surnames, addresses of residence, PESEL numbers (personal identification numbers) and information concerning the subject matter of insurance (passenger car).

At the request of the supervisory authority, the insurance company confirmed that there had been an incident related to a personal data breach, yet the fined company considered that the breach did not require notification to the UODO.

When imposing an administrative fine, the President of the UODO also took into account that the company asked the wrong recipient to permanently delete the correspondence received. However, it is worth mentioning that a request for deletion of data is not tantamount to guaranteeing that the data is actually erased by an unauthorized person and does not preclude possible negative consequences of their use.

The NCPDP, as the national authority for the supervision of personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of the legislative framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount EUR 250,000 applied by Polish Data Protection Authority to ID Finance Poland for loss of confidentiality of the personal data principle.

In the proceedings, the President of the Personal Data Protection Office (UODO)  established that the breach took place following the failure to restore the appropriate security configuration after one of the servers operated by the processor  was restarted. The controller was notified about this by one of its cybersecurity specialists, who detected the vulnerability and indicated sample, publicly available information. ID Finance Poland did not immediately check the system’s identified vulnerabilities and, as a result, a few days later, the data was stolen from this server.

When imposing the fine, the UODO took into account the scale of the breach and the scope of the stolen data. In addition, because unencrypted passwords have also leaked, it is possible to use these data to log in to different customer accounts, if they used the same login (e.g. e-mail) and password on other websites. In establishing the amount of the fine, Polish Data Protection Authority also took into account the controller’s delay in taking preventive measures. The amount of the fine should fulfil both a repressive and a preventive function. In the opinion of the authority, it should prevent similar breaches in the future both in the penalized company and at other controllers’.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the administrative fine in the amount of EUR 450,000 applied by Data Protection Commission to Twitter International Company for the infringement of Article 33(1) and 33(5) of GDPR.

The Data Protection Commission (DPC) investigation commenced in January, 2019 following receipt of a breach notification from Twitter and the DPC has found that Twitter infringed Article 33(1) and 33(5) of the GDPR in terms of a failure to notify the breach on time to the DPC and a failure to adequately document the breach. The DPC has imposed an administrative fine of €450,000 on Twitter as an effective, proportionate and dissuasive measure.

The draft decision in this inquiry, having been submitted to other Concerned Supervisory Authorities under Article 60 of the GDPR in May of this year, was the first one to go through the Article 65 (“dispute resolution”) process since the introduction of the GDPR and was the first Draft Decision in a “big tech” case on which all EU supervisory authorities were consulted as Concerned Supervisory Authorities.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

The National Center for Personal Data Protection (NCPDP), for information and application purposes, communicates about the fines in the amount 100 million EUR and 35 million EUR applied by French Data Protection Authority (CNIL) to Google and Amazon for the  unlawful use of cookies. The fines resulted from two separate investigations carried out by CNIL in relation to the use of cookies on the French websites of Google and Amazon.

CNIL fined Google LLC for 60 million EUR, and Google Ireland Ltd (Google’s headquarters) for 40 million EUR. Combined, these fines are the largest ever sanction handed out by the CNIL. Both Google LLC and Google Ireland Ltd were deemed jointly responsible for the use of cookies as both were considered to exercise decision-making power in relation to personal data processing concerning users located in France.

CNIL also fined Amazon Europe Core, a company registered in Luxembourg and belonging to the Amazon group, the largest online retailer, with 35 million EUR, for the infringement of local legislation on “cookies”.

The French Data Protection Authority specified that the French sites of Google and Amazon did not require the consent of visitors before these cookies were saved on their devices and did not provide internet users with clear information on how the two companies intend to use the results of websites navigation and how the visitors of French sites may refuse the use of cookies.

The NCPDP, as national supervisory authority for personal data processing, emphasizes the responsibility of personal data controllers to comply with the provisions of legal framework on personal data protection and to ensure that personal data processing operations are in accordance with the legislation in force.

Online sessions organized by the Bureau of the Committee of Convention 108

 The high management of the National Center for Personal Data Protection participated at the online sessions organized by the Bureau of the Committee of Convention 108 and the Data Protection Unit of the Council of Europe from the 1st to the 3rd of July, the dates were initially scheduled for the 40th Plenary meeting of the Committee which had to be postponed in light of the current global circumstances. The purpose of the above-mentioned event was to present the work of the Committee to a broader audience than usual. During the event, a wide range of topics was discussed such as:

•        Follow-up and evaluation mechanism;

•        The latest challenges posed by profiling in the era of artificial intelligence;

•        The right to data protection in an educational settings;

•        Digital identity;

•        Facial recognition;

•        Political campaigns and elections.

For more information on each topic you can access the following link:  https://www.coe.int/en/web/data-protection/data-protection-views-from-strasbourg-in-visio-1-3-july

On 12-13 December 2019, EU Twinning Project Experts “Capacity Building of the National Center for Personal Data Protection”, in collaboration with NCPDP, organized a training course “Personal data protection and video surveillance”. The event was hosted by IT Center, Tekwill.
About 185 representatives of public and private institutions attended the course, given the increased interest in this topic, in the context of the last sanctions applied by the NCPDP for the non-compliant processing of personal data through video surveillance systems. Among the institutions that participated in this training course the following can be nominated: State Chancellery, the Ministry of Education, Culture and Research, Information Technology and Cyber Security Service, National Archives, Chamber of Commerce and Industry, Moldova Agroindbank, Orange Moldova, Moldcell, Metro Moldova, etc.
The training course, moderated by the EU Twinning Project Expert, Ian Deguara, and NCPDP representative, Victoria Butușanu, main state inspector, Legal Department, aimed at addressing the topics related to the personal data protection and video surveillance and the impact that the new draft law on personal data protection will generate.
The EU expert, Ian Deguara, mentioned that „Video surveillance should take place taking into account more aspects. Before installing video surveillance devices, you should ask yourself, when, where and for what purpose should I install video surveillance cameras? If we are talking about an apartment block, you have to obtain the consent of the owners, if we are talking about a public space, they have to be installed in such a way that they do not capture the private property near or the access area of the neighbors, etc.”. At the same time, the EU expert addressed topics such as: the notion of applicability, accountability principle, the use of video cameras for domestic purposes, fake cameras, recording for an altitude, vehicle reversing cameras, necessity of processing and proportionality, the legal basis for data processing, the disclosure of footage to third parties, transparency obligation, the right of access, the storage period of recordings, the security of data processing and data protection impact assessment.
NCPDP representative, Victoria Butușanu, spoke about the new draft law, the rights of data subjects, the concept of “controller” and “processor”, the principles of personal data processing, thus providing a number of practical examples.
The training course was conducted within the EU Twinning Project “Capacity building of the National Center for Personal Data Protection”, funded by European Union. The project is implemented between October 2017 and January 2020 by the German Foundation for International Legal Cooperation (IRZ) and the Ministry of Justice of Latvia.