The Polish DPA Fines A Controller For Not Verifying A Processor And For Not Concluding A Data Processing Agreement

In September, the Polish DPA issued a decision fining a controller (a cultural institution) PLN 2500 for engaging a processor without concluding a data processing agreement in writing and without verifying whether the processor provided sufficient guarantees for the implementation of appropriate technical measures.

The fine was so low because under Polish law the maximum fine for infringement of data protection law that can be imposed on a public cultural institution is PLN 10,000. Thus, the fine imposed in this case was 25% of the maximum amount.

The DPA launched an investigation following a personal data breach notification by the controller. In the course of the investigation, it was established that the controller entrusted the processing of personal data to an accounting company without concluding a written data processing agreement. The processor was responsible for keeping accounting books, records, preparing reports about finance, taxes and social