On 15 March 2019, the Polish supervisory authority issued the
first decision imposing an administrative fine in the amount of PLN
943,000 (approx. EUR 220,000) for the infringement of the
information obligation stipulated in Article 14 of the Regulation
(EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data,
and repealing Directive 95/46/EC (General Data Protection
Regulation) (the "GDPR").
Background
The fine was imposed on a company (data broker) which processes,
in particular, the data of individuals conducting business
activity, as well as of board members. The data was obtained from
publicly available registers. The company fulfilled the information
obligation only towards approx. 680,000 individuals who had
disclosed their e-mail addresses in the registers. All remaining
individuals (over 6 million people) were not
