Failure to comply with the obligations may result with a fine for the controller

Warsaw University of Technology was fined PLN 45,000 (approximately EUR 9,900), among other things, for not implementing the appropriate technical and organizational measures to ensure the ability for constant assurance of the confidentiality of processing services, also for the lack of regular testing, assessing and evaluating the effectiveness of measures. The University did not take into consideration the risk related to the processing of data within the application.

The proceedings against that controller was initiated after the Personal Data Protection Office (UODO) received a data breach notification. As it was indicated, an unauthorized person downloaded from the University’s IT network resources a database containing personal data of students and lecturers (over 5 thousand people).

As it was established during the administrative proceedings the establishment of the Warsaw University of Technology used an application created by the University’s employees, which was used to enrol for courses and allowed the user to have insight into the history of teaching, grades and calculations of fees. This application was modified depending on the controller’s needs. At the beginning of January 2020, an unauthorized person having credentials used the functionality of uploading files to the app. In turn, at the beginning of May 2020, an unauthorized download of personal data was made.

A note should be taken that the controller is responsible for implementing appropriate technical and organizational measures to ensure the security of the personal data processed.

According to the UODO, the controller did not provide evidence of compliance with these obligations, whereby it failed to perform a formal risk assessment, and identified risks by collecting information from University’s units. Furthermore, it did not justify the adequacy of the safeguards used to address the risk. The University focused on securing its IT infrastructure against threats. However, it did not take into account the risks associated with the functioning of the application created by its employees.

According to the UODO, the application of technical measures without a prior risk analysis of the processing of personal data cannot provide a guarantee that the measures applied will be effective and adequate.

Attention should also be paid to the fact that the GDPR, the General Data Protection Regulation, obliges the controller to regularly test, assess and evaluate the effectiveness of technical and organisational measures to ensure the security of processing. The controller should actively test the security of personal data at every stage. According to the UODO's findings, the University did not periodically verify the measures applied.

Taking into account the controller's failure to comply with its obligations and the high risk of adverse effects in the future for persons affected by the incident, the supervisory authority found it reasonable and necessary to impose an administrative fine of PLN 45,000 (approximately EUR 9,900).

Warsaw University of Technology was fined PLN 45,000 (approximately EUR 9,900), among other things, for not implementing the appropriate technical and organizational measures to ensure the ability for constant assurance of the confidentiality of processing services, also for the lack of regular testing, assessing and evaluating the effectiveness of measures. The University did not take into consideration the risk related to the processing of data within the application.