Topic: Duty to inform | Transparency
Authority: UODO (Urząd Ochrony Danych Osobowych – Polish Data Protection Supervisory Authority)
Sanction: € 220’000.00
The sanctioned company had obtained data from over 6 million people from a public register and had not informed all of them (Art. 14 DSGVO). The company only informed the approximately 90,000 people of whom it had an e-mail address. In the case of the other persons – for whom only postal addresses were available – the company argued that postal information by registered mail would have been too expensive and disproportionate.
However, the supervisory authority sentenced the company to a fine of € 220,000, as it could also have complied with the duty to provide information by post (without registered mail). The importance of the duty to provide information in this case was demonstrated by the approx. 12,000 appeals against data