Poczta Polska rejects the UODO accusations. He will appeal against the million-dollar fine in court

Poczta Polska does not agree with the arguments of the Personal Data Protection Office and intends to appeal against the fine imposed on Monday by the Office to the administrative court – Joanna Trzaska-Wieczorek, spokeswoman for the postal operator, told PAP.

On Monday, the Personal Data Protection Office imposed a fine of almost PLN 1 million on Poczta Polska, accusing the company of lack of independence in the function of the data protection officer (DPO). As explained by the Personal Data Protection Office, the same person performed the function of the Data Protection Officer at the same time as a managerial and substantive position related to the processing of personal data.

Trzaska-Wieczorek pointed out that the President of the Personal Data Protection Office in his decision indicated that the violation lasted from the moment the provisions of the GDPR came into force (in 2018, the EU GDPR regulation entered into force – PAP) until November 2024. “At that time, there were changes in the organizational structure of the company and corrective actions were taken, which resulted in the separation of the function of the Data Protection Inspector as an independent organizational unit reporting directly to the management board,” she assured. spokeswoman for Poczta Polska.

She emphasized that “it was the current management board of the company that noticed and changed the approach to locating the IOD within Poczta Polska.”

“Regardless of the above, the company has carefully analyzed the received decision, does not agree with the argumentation presented therein and will therefore appeal against it to the administrative court,” she declared.

In its Monday announcement, the Personal Data Protection Office announced the imposition of PLN 978,000. PLN fine for Poczta Polska and found that it did not guarantee that the performance of tasks by the Data Protection Inspector did not cause a conflict of interests. It was supposed to consist in failure to ensure the independence of the DPO due to the fact that he simultaneously held a managerial and substantive position related to the processing of personal data.

The Office indicated that in Poczta Polska the position of DPO was performed by a person who also had an “authoritative position” in the scope of, among others, security issues and protection of classified information. This raised the Personal Data Protection Office's doubts regarding providing the inspector with conditions guaranteeing independence, effectiveness and objectivity. “It is unacceptable to bind the IOD with the principal's instructions and to concentrate both functions – the personal data administrator and the independent inspector – by appointing them to one person,” the supervisory authority emphasized. (PAP)

jls/ mrr/