UODO (Polish DPA) — Bank (anonymised, DKN.5112.14.2022)

Decided by

Prezes Urzędu Ochrony Danych Osobowych

Parties

Prezes Urzędu Ochrony Danych Osobowych v. C. S.A.

Decision date

December 18, 2024

Remedy

The President of the Personal Data Protection Office imposed two administrative fines totaling 576 220 PLN on C. S.A. for failing to guarantee the independence of its Data Protection Officer and for failing to account for profiling in its record of processing activities and data protection impact assessment.

Amount

PLN 576,220

Appeal

Appeal status not stated

Key holdings

1. The authority imposed a fine of 261,918 PLN on C. S.A. for failing to ensure that the Data Protection Officer reported directly to highest management and received no operational instructions.

   “niezapewnieniu przez C. S.A., jako administratora, by inspektor ochrony danych podlegał bezpośrednio najwyższemu kierownictwu administratora oraz nie otrzymywał instrukcji dotyczących wykonywania swoich zadań” — Point 1

2. The authority imposed a fine of 314,302 PLN for failing to record profiling operations in the record of processing activities and failing to carry out a dedicated Data Protection Impact Assessment for profiling.

   “niedokonaniu oceny skutków dla ochrony danych osobowych w odniesieniu do czynności przetwarzania danych polegających na ich profilowaniu” — Point 2 b)

3. Employing a Data Protection Officer within an operational department under a departmental director who creates processing procedures compromises the officer's required independence under GDPR Article 38(3).

   “pełna podległość służbowa inspektora ochrony danych wobec Dyrektora Departamentu (…) wyklucza możliwość zapewnienia, aby inspektor nie otrzymywał instrukcji dotyczących wykonywania jego zadań” — Section II.1

4. Automated profiling for customer credit assessment must be explicitly distinguished and documented in the record of processing activities rather than subsumed under general product operational descriptions.

   “C. S.A. powinien był w prowadzonym przez niego rejestrze czynności przetwarzania uwzględnić również profilowanie jako specyficzną formę i zarazem istotny etap przetwarzania danych klientów” — Section II.2.1

In plain English

On December 18, 2024, the President of the Personal Data Protection Office in Poland issued a decision imposing two administrative fines totaling 576 220 PLN on financial institution C. S.A. following an ex officio audit conducted between May 2022 and August 2023 regarding customer data profiling for credit assessments. The regulator found multiple violations of the EU General Data Protection Regulation. First, C. S.A. failed to ensure the independence of its Data Protection Officer. The officer was employed as a specialist within an operational department and reported hierarchically to that department's director rather than directly to top management, creating a structure where instructions could be issued. The authority imposed a fine of 261 918 PLN for this violation, noting it had persisted for over 3 years since June 2020. Second, C. S.A. failed to explicitly include customer data profiling in its record of processing activities and omitted profiling from its data protection impact assessment. The bank had treated profiling merely as an undisclosed element of broader credit product operations. The regulator emphasized that credit profiling creates automated credit risk scores using personal identifiers like PESEL national identification numbers, requiring transparent documentation and dedicated risk assessment. The authority imposed a fine of 314 302 PLN for these record-keeping and impact assessment failures, which lasted approximately 4.5 years. Although C. S.A. implemented corrective measures during the proceedings by restructuring the officer's reporting line directly under the management board and updating its records and impact assessments, the regulator determined that financial penalties were necessary due to prior compliance warnings and the significant risks associated with automated customer profiling.