Poland

UODO fined Orange Polska after weaknesses in customer authentication and rights-handling processes exposed subscriber data, implicating GDPR Articles 12, 15 and 32.

UODO scrutinized processing of voter-related and citizen address data by Polish Post, emphasizing lawful basis, necessity, and accountability under GDPR Articles 5, 6 and 24.

UODO examined mBank's customer-data retention and internal access governance, identifying minimization and security shortcomings under GDPR Articles 5 and 32.

UODO sanctioned Play over inadequate customer verification and unauthorized SIM-related disclosures, citing GDPR Articles 25 and 32.

UODO imposed a fine after personal data was disclosed through an online recruitment process without adequate safeguards, contrary to GDPR Articles 5 and 32.

UODO fined a lender for failing to notify a personal data breach promptly and for inadequate security measures, engaging GDPR Articles 33 and 34.

UODO reviewed Santander's retention and disclosure controls after customer data incidents and found shortcomings under GDPR Articles 5, 24 and 32.

UODO fined Virgin Mobile after inadequate authentication procedures enabled unauthorized access to customer data, implicating GDPR Articles 5 and 32.

UODO fined Morele.net after a major breach affecting millions of users, finding inadequate technical and organizational measures and weak authentication controls under GDPR Articles 5, 24 and 32.

UODO sanctioned Bisnode for failing to inform millions of sole traders that their data had been obtained and processed, violating GDPR Articles 12, 13 and 14.