This case, confirmed at the final instance by the Polish judiciary, highlights the importance for a data controller to implement the security measures it has identified as necessary in its risk assessment, and to do so before an incident occurs.

Facts and context

The Polish data protection authority (Urząd Ochrony Danych Osobowych, UODO) issued a sanction decision, confirmed at the final instance by the Polish judiciary, against the Commander of the Provincial Command of Mazovia of the Voluntary Labour Corps (OHP), including the imposition of a fine of 15,000 PLN (approximately €3,500) for breaches related to data security following the theft of a work computer.

The case originated from an investigation opened following the theft of a professional laptop containing the data of three individuals, stolen from a vehicle during a trip.

Grounds for the decision

• Obligation to ensure the security of processing (Article 32 of the GDPR): The authority found that the stolen laptop was protected only by a username and password, without data encryption. However, the risk assessment conducted by the data controller itself had classified the risk of theft as "high and unacceptable" and had recommended the implementation of an encryption tool. Since this measure was only deployed after the incident, the UODO concluded that the data controller had not implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, nor had it regularly tested and evaluated them. The argument that the laptop was protected by a password and the vehicle by an alarm was deemed insufficient.

Authority's decision

Consequently, the authority imposed a fine of 15,000 PLN (approximately €3,500) on the organisation.

Lessons learned

This decision, validated by the highest Polish administrative courts, reminds that:

• Failure to implement the security measures identified as necessary in one's own risk assessment constitutes a breach, especially when the risk has materialised.
• Protecting a laptop with a simple password, without disk encryption, is not considered a sufficient technical security measure, especially when the device is used in a mobile context.
• Compliance with legal obligations, such as notifying data subjects or the absence of prior violations, does not constitute a mitigating circumstance but the normal execution of a data controller's duties.