The Polish Data protection Authority, stating that PNP SA with its registered office in Warsaw violated the provisions of the General Data Protection Regulation, imposed an administrative fine on the company in the amount of over PLN 22 000 (EUR 5 000).
The reason for the fine is the failure to cooperate with the supervisory authority and to provide access to all information necessary for the Polish DPA to carry out its tasks.
In order to determine the facts of the case initiated by the complaint, the Polish DPA requested the fined company three times to respond to the complaint and to provide explanations. None of the requests sent to the company - to the addresses disclosed in the Register of Entrepreneurs of the National Court Register as the company's registered office addresses - was received by the company, despite being served twice. Therefore, the requests sent to the company were deemed delivered.
As a consequence of the company's failure to respond to the correspondence addressed to it, the Polish DPA did not obtain the information necessary to examine the case. The initiation of the proceedings to impose an administrative fine on the company did not change the situation either. The letter informing about the initiation of such proceedings was not received by the company either.
The decision emphasised that the company is liable for failing to provide the Polish DPA with the information it requested. The fact that the requests submitted by the Polish DPA to the company were not ultimately received by the company does not change this circumstance. Quoting the administrative courts’ rulings, it was indicated that the obligation of each organisational unit is to ensure the collection of letters in such a way that the flow of correspondence takes place continuously and undisturbed and only by authorised persons. Negligence in this respect is the responsibility of the organisational unit.
The obligation to cooperate with the supervisory authority is identical for the controller and the processor. This cooperation shall include the necessity to provide the supervisory authority - on its request - with any information in the controller's or processor's possession related to the proceedings carried out.
It should be concluded that the company, by failing to respond to the Polish DPA's requests, breached its obligation to provide the supervisory authority with access to information necessary to perform its tasks - in this case, to resolve the case on its merits.
In the opinion of the Polish DPA, the imposed administrative fine will discipline the company to properly cooperate with the supervisory authority both in the further course of the proceedings concerning the examination of the complaint and in any other future proceedings with the participation of the company before the Office.
The full text of the decision is available in Polish here
For further information, please contact the Polish DPA: kancelaria@uodo.gov.pl
The press release published here does not constitute official EDPB communication, nor an EDPB endorsement. This press release was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. As the press release is represented here as it appeared on the SA's website or other channels of communication, the news item is only available in English or in the Member State's official language with a short introduction in English. Any questions regarding this press release should be directed to the supervisory authority concerned.