The Polish Data Protection Authority (UODO) imposed its first fine for a violation of the General Data
Protection Regulation 2016/679 (GDPR). Bisnode, a data aggregation
company headquartered in Sweden, was fined just under PLN 1 million
(around EUR 220,000). The decision found that Bisnode had failed in
its duties to inform data subjects how it processes their personal
data under GDPR article 14.
GDPR article 14
GDPR article 14 requires companies to explain to individuals how
they process their personal data if the companies did not obtain it
directly from the individuals. A typical example is companies
gleaning information from open sources, such as a social media
profiles. GDPR article 14 requires controllers to explain to
affected individuals what personal data is processed, how it is
processed, how long it will be retained, and so on.
