Polish National Personal Data Protection Office (UODO)-Szczecin-Centrum District Court (1/19/2023)

The court had reported a data breach to the DPA involving the loss of three data carriers. One data carrier was an official and encrypted one, the other two were private and unencrypted data carriers containing drafts of court rulings and statements with personal data.

In the course of its investigation, the DPA discovered that data carriers which had not been checked and secured by the court’s IT department had been used on official computers over a period of many years. In addition, the DPA found that although there were regulations prohibiting the use of private data carriers, the court failed to check whether employees actually complied with these regulations. In addition, the court failed to implement technical measures to prevent the use of private data carriers.