The Polish data protection authority sanctioned an entrepreneur for failing to cooperate during an investigation, emphasizing that this obligation is autonomous and that non-compliance justifies a financial penalty, even in the absence of a decision on the substantive breaches that initiated the procedure.

Facts and context

The Polish data protection authority (UODO) today published a sanction decision against an entrepreneur from Krakow, including the imposition of a fine of 31,507 PLN (approximately €7,300), for breaches related to his obligation to cooperate with the supervisory authority.

The case originated from an investigation by the authority concerning possible irregularities in the processing of personal data on two websites, lexspace.pl and adwokatura.info, operated by the entrepreneur. These platforms processed data of legal professionals (legal advisors and lawyers) as well as individuals seeking legal advice.

Grounds for the decision

• Obligation to cooperate with the supervisory authority (Article 31 of the GDPR): The authority found that the websites did not display the contact details of the data controller, preventing data subjects from exercising their rights. After identifying the entrepreneur as the data controller, he initially cooperated but then provided explanations deemed insufficient. Despite multiple reminders by phone and email, and after being informed that failure to cooperate could lead to a fine, the entrepreneur stopped responding. The authority considered that this passive, even contemptuous attitude made an objective, thorough, and complete examination of the case impossible, thus hindering its supervisory mission.

Decision of the authority

Consequently, the authority imposed a fine of 31,507 PLN (approximately €7,300) on the entrepreneur.

Lessons learned

This decision reminds that:

• The obligation to cooperate with a supervisory authority, provided for in Article 31 of the GDPR, constitutes an autonomous obligation whose non-compliance can be sanctioned independently of any substantive breaches.
• Initial cooperation with the supervisory authority is not sufficient; the data controller must respond fully and continuously to all requests for information throughout the procedure.
• Ignoring requests from a supervisory authority and thus hindering its investigative mission is considered a serious breach justifying the imposition of a financial penalty.