Regional Court in Warsaw: Financial Ombudsman ordered to pay PLN 40,000 for data leak reaching 28,000 entities The judgment of the Regional Court in Warsaw (Sąd Okręgowy w Warszawie) in case III C 904/23 is one of the most significant published examples of the application of Article 82 GDPR by Polish civil courts in a dispute in which a public body stands on the opposite side. The Court established the liability of the Financial Ombudsman (Rzecznik Finansowy) as a data controller, rejected exculpatory arguments and awarded compensation of PLN 40,000 — despite the fact that the claimant demonstrated no material damage. What was the case about? On 11 February 2021, a personal data breach occurred at the Office of the Financial Ombudsman. As a result of an employee error, a letter addressed to the President of the Management Board of an insurance company — containing the claimant’s full name, correspondence address, policy number and name, case reference number assigned by the Financial Ombudsman, and names of financial market entities — was sent to 28,366 institutions and entities registered in the ePUAP electronic platform. The Financial Ombudsman notified the claimant of the incident by letter dated 12 February 2021, identifying potential consequences: stress arising from the breach and loss of control over personal data, receipt of unsolicited correspondence, and the risk of impersonation of the claimant. Simultaneously, the Ombudsman requested all entities that had received the letter to delete or anonymise the claimant’s personal data. Despite these steps, the Ombudsman subsequently refused to accept liability for the incident. By decision dated 30 September 2022, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) reprimanded the Financial Ombudsman for infringing […]