The President of the Polish DPA found the breach of GDPR and imposed an administrative fine in the amount of PLN 100 000 (nearly EUR 22 000) on KSSIP for failing to fulfil its obligations as a controller.
According to the Personal Data Protection Office, the controller did not take the necessary technical and organisational measures, which would allow to ensure the confidentiality of the processing services. KSSIP failed to test and did not carry out the impact assessment of effectiveness of the technical and organisational measures in order to ensure the security of personal data contained in the copy of the database of the training platform of the KSSIP, and thus improperly took into account the risks associated with changes in the processing of personal data.

In addition, it should be pointed out that the controller entrusted the processing of personal data to a processor without contractual binding commitment to process personal data only on documented instructions from the controller.

Let us recall, the KSSIP notified to the UODO a breach of personal data protection,



in connection with the notification by the National Police Headquarters of the appearance on the Internet of personal data related to the domain kssip.gov.pl. The notified incident involved unknown persons gaining unauthorized access to a copy of the KSSIP training site database created during a test migration to a recent training platform. The breach involved the personal data of more than 50 000 people, users subject to continuous training, whose personal data were collected on the KSSIP training platform. Those persons hold positions, among others, of judges, court assessors, prosecutors and assistant prosecutors, law clerks.

Organizational and technical measures
A controller implements appropriate technical and organizational measures so that the processing of personal data should be carried out in accordance with the GDPR. These measures shall be reviewed and updated as necessary. This means t

📌 Polish DPA fines the National School of Judiciary and Public Prosecution (Anupgarh)
🏢 EFDPO European Federation of Data Protection Officers
📍 Anupgarh