The President of the Personal Data Protection Office intervenes with the President of Poczta Polska

Mirosław Wróblewski, the President of the Personal Data Protection Office, is worried about the scale of personal data breaches concerning the loss of packages containing data sent by controllers. Often the packages contain important documents with a wide range of personal data or even medical examination results. Therefore, the President of the Personal Data Protection Office asked Sebastian Mikosz, the President of Poczta Polska (the Polish Post), to take urgent actions aimed at developing solutions to limit such events and strengthen cooperation with the senders of such packages.

The President of the Personal Data Protection Office, in a letter dated April 2 this year addressed to the President of the Polish Post, pointed out that numerous cases of packages being lost or delivered to the wrong people constitute a serious problem for the controllers. They must notify the personal data breach to the supervisory authority due to the fact that the packages contain personal data - in many cases special categories of personal data.

The President of the Personal Data Protection Office reminds that the problem with the loss of packages containing data or their improper delivery is not a new thing. In 2019 - 2020, the supervisory authority corresponded with the Polish Post  and at that time the postal operator undertook, among other things, to conduct training of delivery service employees on personal data protection, to issue a recommendation not to send registered packages to mailboxes and contact points, or to increase supervision over the correct delivery of packages.

In his letter, the President of the Personal Data Protection Office also asks for an answer as to whether the Polish Post monitors the effectiveness of previously implemented measures to strengthen the security of packages and whether it plans to introduce additional security measures in this regard.

The content of the letter (in Polish) from the President of the Personal Data Protection Office can be read in the file attached below.