https://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKN.5131.29.2022&feed=atom&action=historyUODO (Poland) - DKN.5131.29.2022 - Revision history2024-03-29T11:05:11ZRevision history for this page on the wikiMediaWiki 1.39.6https://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKN.5131.29.2022&diff=28322&oldid=prevKk at 14:39, 28 September 20222022-09-28T14:39:26Z<p></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:39, 28 September 2022</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l65">Line 65:</td>
<td colspan="2" class="diff-lineno">Line 65:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The Polish DPA <del style="font-weight: bold; text-decoration: none;">imposed </del>a €529 <del style="font-weight: bold; text-decoration: none;">fine on the controller </del>for not concluding a written <del style="font-weight: bold; text-decoration: none;">authorisation </del>agreement <del style="font-weight: bold; text-decoration: none;">with the processor, thereby violating </del>[[<del style="font-weight: bold; text-decoration: none;">Article 28 GDPR|</del>Article 28 GDPR]].</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The Polish DPA <ins style="font-weight: bold; text-decoration: none;">fined </ins>a <ins style="font-weight: bold; text-decoration: none;">cultural organisation </ins>€529 for not concluding a written agreement <ins style="font-weight: bold; text-decoration: none;">under </ins>[[Article 28 GDPR]] <ins style="font-weight: bold; text-decoration: none;">with its processor</ins>.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Facts ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Facts ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>In May 2020, the Polish DPA received a notification of personal data breach caused by the Sułkowice Cultural Centre (the controller). The data breach affected 30 persons, including employees of the controller. The DPA initiated an investigation, in which it found that the controller entrusted the processing of personal data to an entity (the processor) without entering into a written <del style="font-weight: bold; text-decoration: none;">entrustment </del>agreement. Moreover, they did not verify whether the processor provides sufficient guarantees of the implementation of appropriate technical and organisational measures in accordance with the GDPR.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>In May 2020, the Polish DPA received a notification of personal data breach caused by the Sułkowice Cultural Centre (the controller). The data breach affected 30 persons, including employees of the controller. The DPA initiated an investigation, in which it found that the controller entrusted the processing of personal data to an entity (the processor) without entering into a written <ins style="font-weight: bold; text-decoration: none;">data processing </ins>agreement. Moreover, they did not verify whether the processor provides sufficient guarantees of the implementation of appropriate technical and organisational measures in accordance with the GDPR.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The processor was responsible for keeping accounting books and records as well as preparing reports. Therefore, they were entrusted with the processing of employee's and former employee's personal data, including names, dates of birth, bank account numbers, residence addresses, personal identification number (PESEL), email addresses, data on earnings and/or property, the mother's family names, series and numbers of ID cards, telephone numbers, and health data.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The processor was responsible for keeping accounting books and records as well as preparing reports. Therefore, they were entrusted with the processing of employee's and former employee's personal data, including names, dates of birth, bank account numbers, residence addresses, personal identification number (PESEL), email addresses, data on earnings and/or property, the mother's family names, series and numbers of ID cards, telephone numbers, and health data.</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l77">Line 77:</td>
<td colspan="2" class="diff-lineno">Line 77:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Holding ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>First, the Polish DPA reiterated [[Article 28 GDPR#1|Article 28(1) GDPR]], which prescribes that sufficient guarantees to implement appropriate technical and organisational measures must exist whenever the controller mandates data processing activities to be carried out on their behalf. Moreover, in line with [[Article 28 GDPR#3|Article 28(3) GDPR]], <del style="font-weight: bold; text-decoration: none;">an authorisation </del>agreement must be concluded between the controller and the processor, which stipulates the conditions of processing. Additionally, [[Article 28 GDPR#9|Article 28(9) GDPR]] requires the agreement to be in writing, including in electronic form. </div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>First, the Polish DPA reiterated [[Article 28 GDPR#1|Article 28(1) GDPR]], which prescribes that sufficient guarantees to implement appropriate technical and organisational measures must exist whenever the controller mandates data processing activities to be carried out on their behalf. Moreover, in line with [[Article 28 GDPR#3|Article 28(3) GDPR]], <ins style="font-weight: bold; text-decoration: none;">a data processing </ins>agreement must be concluded between the controller and the processor, which stipulates the conditions of processing. Additionally, [[Article 28 GDPR#9|Article 28(9) GDPR]] requires the agreement to be in writing, including in electronic form. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Second, the DPA clarified the roles of the entities involved in processing. As the employer and main administrator, the Cultural Centre was considered to be the controller. Meanwhile, the entity entrusted with keeping accouting records should be the processor as they were only processing data on the controller's behalf. Hence, it was the responsibility of the controller to fulfill the requirements of [[Article 28 GDPR|Article 28 GDPR]]. </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Second, the DPA clarified the roles of the entities involved in processing. As the employer and main administrator, the Cultural Centre was considered to be the controller. Meanwhile, the entity entrusted with keeping accouting records should be the processor as they were only processing data on the controller's behalf. Hence, it was the responsibility of the controller to fulfill the requirements of [[Article 28 GDPR|Article 28 GDPR]]. </div></td></tr>
</table>Kkhttps://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKN.5131.29.2022&diff=28282&oldid=prevKk: /* Facts */2022-09-28T07:44:27Z<p><span dir="auto"><span class="autocomment">Facts</span></span></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 07:44, 28 September 2022</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l70">Line 70:</td>
<td colspan="2" class="diff-lineno">Line 70:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Facts ===</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>=== Facts ===</div></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>In May 2020, the Polish DPA received a notification of personal data breach caused by the Sułkowice Cultural Centre (the controller). The data breach affected 30 persons, including employees of the <del style="font-weight: bold; text-decoration: none;">Centre</del>. The DPA initiated an investigation, in which it found that the controller entrusted the processing of personal data to an entity (the processor) without entering into a written entrustment agreement <del style="font-weight: bold; text-decoration: none;">and without verifying </del>whether the processor provides sufficient guarantees of the implementation of appropriate technical and organisational measures in accordance with the GDPR.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>In May 2020, the Polish DPA received a notification of personal data breach caused by the Sułkowice Cultural Centre (the controller). The data breach affected 30 persons, including employees of the <ins style="font-weight: bold; text-decoration: none;">controller</ins>. The DPA initiated an investigation, in which it found that the controller entrusted the processing of personal data to an entity (the processor) without entering into a written entrustment agreement<ins style="font-weight: bold; text-decoration: none;">. Moreover, they did not verify </ins>whether the processor provides sufficient guarantees of the implementation of appropriate technical and organisational measures in accordance with the GDPR.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The processor was responsible for keeping accounting books and records as well as preparing reports. Therefore, <del style="font-weight: bold; text-decoration: none;">the processor was </del>entrusted with the processing of employee's and former employee's personal data, including <del style="font-weight: bold; text-decoration: none;">names and surnames, parents' </del>names, dates of birth, bank account numbers, addresses <del style="font-weight: bold; text-decoration: none;">of residence or stay</del>, personal identification number (PESEL), <del style="font-weight: bold; text-decoration: none;">e-mail </del>addresses, data on earnings and/or property, the mother's family names, series and numbers of ID cards, telephone numbers, and health data.</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The processor was responsible for keeping accounting books and records as well as preparing reports. Therefore, <ins style="font-weight: bold; text-decoration: none;">they were </ins>entrusted with the processing of employee's and former employee's personal data, including names, dates of birth, bank account numbers, <ins style="font-weight: bold; text-decoration: none;">residence </ins>addresses, personal identification number (PESEL), <ins style="font-weight: bold; text-decoration: none;">email </ins>addresses, data on earnings and/or property, the mother's family names, series and numbers of ID cards, telephone numbers, and health data.</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Since the Polish DPA was not able to obtain information on any contract concluded between the controller and the processor with regards to the above-discussed processing operations, the DPA initiated ex officio administrative proceesings against the controller.</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>Since the Polish DPA was not able to obtain information on any contract concluded between the controller and the processor with regards to the above-discussed processing operations, the DPA initiated ex officio administrative proceesings against the controller.</div></td></tr>
<tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l79">Line 79:</td>
<td colspan="2" class="diff-lineno">Line 79:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>First, the Polish DPA reiterated [[Article 28 GDPR#1|Article 28(1) GDPR]], which prescribes that sufficient guarantees to implement appropriate technical and organisational measures must exist whenever the controller mandates data processing activities to be carried out on their behalf. Moreover, in line with [[Article 28 GDPR#3|Article 28(3) GDPR]], an authorisation agreement must be concluded between the controller and the processor, which stipulates the conditions of processing. Additionally, [[Article 28 GDPR#9|Article 28(9) GDPR]] requires the agreement to be in writing, including in electronic form. </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>First, the Polish DPA reiterated [[Article 28 GDPR#1|Article 28(1) GDPR]], which prescribes that sufficient guarantees to implement appropriate technical and organisational measures must exist whenever the controller mandates data processing activities to be carried out on their behalf. Moreover, in line with [[Article 28 GDPR#3|Article 28(3) GDPR]], an authorisation agreement must be concluded between the controller and the processor, which stipulates the conditions of processing. Additionally, [[Article 28 GDPR#9|Article 28(9) GDPR]] requires the agreement to be in writing, including in electronic form. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>Second, the DPA clarified the roles of the entities involved in processing. As the employer and main administrator, the Cultural Centre was considered to be the controller. Meanwhile, the entity entrusted with keeping accouting records should be the processor as they were only processing data on the controller's behalf. Hence, it was the responsibility of the controller to <del style="font-weight: bold; text-decoration: none;">fulfil </del>the requirements of [[Article 28 GDPR|Article 28 GDPR]]. </div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>Second, the DPA clarified the roles of the entities involved in processing. As the employer and main administrator, the Cultural Centre was considered to be the controller. Meanwhile, the entity entrusted with keeping accouting records should be the processor as they were only processing data on the controller's behalf. Hence, it was the responsibility of the controller to <ins style="font-weight: bold; text-decoration: none;">fulfill </ins>the requirements of [[Article 28 GDPR|Article 28 GDPR]]. </div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The DPA concluded that the controller failed to comply with Article 28(1)(3) and (9) GDPR by not concluding a written agreement with the processor. It imposed a €529 fine on the controller for this violation. </div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>The DPA concluded that the controller failed to comply with Article 28(1)(3) and (9) GDPR by not concluding a written agreement with the processor. It imposed a €529 fine on the controller for this violation. </div></td></tr>
</table>Kkhttps://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKN.5131.29.2022&diff=28239&oldid=prevKk at 10:16, 23 September 20222022-09-23T10:16:07Z<p></p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 10:16, 23 September 2022</td>
</tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l65">Line 65:</td>
<td colspan="2" class="diff-lineno">Line 65:</td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>}}</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>The Polish DPA imposed a €529 fine on the controller for not concluding a written authorisation agreement with the processor thereby violating [[Article 28 GDPR|Article 28 GDPR]].</div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>The Polish DPA imposed a €529 fine on the controller for not concluding a written authorisation agreement with the processor<ins style="font-weight: bold; text-decoration: none;">, </ins>thereby violating [[Article 28 GDPR|Article 28 GDPR]].</div></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><br/></td></tr>
<tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>== English Summary ==</div></td></tr>
</table>Kkhttps://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKN.5131.29.2022&diff=28238&oldid=prevKk: Created page with "{{DPAdecisionBOX |Jurisdiction=Poland |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoPL.png |DPA_Abbrevation=UODO |DPA_With_Country=UODO (Poland) |Case_Number_Name=DKN..."2022-09-23T10:15:45Z<p>Created page with "{{DPAdecisionBOX |Jurisdiction=Poland |DPA-BG-Color=background-color:#ffffff; |DPAlogo=LogoPL.png |DPA_Abbrevation=UODO |DPA_With_Country=UODO (Poland) |Case_Number_Name=DKN..."</p>
<a href="https://gdprhub.eu/index.php?title=UODO_(Poland)_-_DKN.5131.29.2022&diff=28238">Show changes</a>Kk