The Polish authority sanctions an individual not for the initial unlawful video surveillance, but for non-compliance with a prior decision ordering them to cease this processing, thus illustrating the seriousness of failing to comply with an injunction from the supervisory authority.

Facts and context

The Polish data protection authority (UODO) has today published a sanction decision against an individual, including the imposition of a fine of 26,711 PLN (approximately €6,241), for breaches related to non-compliance with an injunction from the authority.

The case originated from complaints by neighbors concerning a video surveillance system continuously recording image and sound in public areas and adjacent properties.

Grounds for the decision

After an initial procedure, the authority ordered the individual to cease data processing or reconfigure their cameras within seven days to film only their property. The decision became final and was not executed, leading the UODO to initiate a new procedure to sanction this specific breach.

• Failure to comply with an injunction from the supervisory authority: The authority found that the sanctioned individual did not execute the prior decision, despite a formal notice remaining unanswered. By ignoring this injunction, the data controller committed a separate breach. The authority emphasized that this inaction prolonged the initial unlawful processing of several individuals' data (image, voice, location), causing a feeling of constant surveillance and a continuing infringement on their privacy. The duration of this breach, nearly six months without justification, was considered an aggravating circumstance in calculating the fine amount.

Authority's decision

Consequently, the authority imposed a fine of 26,711 PLN (approximately €6,241) on the individual concerned.

Lessons learned

This decision reminds that:

• Non-compliance with a binding corrective measure, such as an injunction issued by a supervisory authority, constitutes a distinct and serious breach, subject to administrative sanction.
• The length of time a data controller ignores an authority's decision is an aggravating factor considered in determining the fine amount.
• The use of a video surveillance system by a private individual must not extend to public areas or neighboring properties, as such processing is generally considered unlawful and disproportionately infringes on privacy.
• Supervisory authorities have enforcement means for recovering fines, which may involve national tax administrations seizing the offender's income or assets.