UODO (Polish DPA) — Catering business, Silesian Voivodeship (DKE.561.1.2025)
UODO fined a catering entrepreneur PLN 18,941 for obstructing an investigation into the employer's processing of an employee's biometric data (fingerprints) by failing to provide UODO with access and required information.
Key takeaway — how to prevent this
Biometric data (faces, iris, fingerprints) needs an explicit lawful basis or consent. Scraping or capturing it without one is unlawful across the EU/UK and many US states (e.g. Illinois BIPA) — and draws the largest fines.
Case brief
Read from the authority's press release on 2026-09-06. Every holding carries a short verbatim quote from that text (in PL, the document's language).
- Decided by
- Prezes Urzędu Ochrony Danych Osobowych
- Parties
- Prezes Urzędu Ochrony Danych Osobowych v. Przedsiębiorca prowadzący działalność gastronomiczną z województwa śląskiego
- Decision date
- July 28, 2025
- Remedy
- An administrative fine of 18,941 PLN was imposed on the catering business for failing to provide information and access to personal data required by the authority.
- Amount
- PLN 18,941
- Appeal
- Appeal status not stated
Key holdings
The President of the Personal Data Protection Office imposed a fine of 18,941 PLN on a catering business for withholding required information and access to personal data.
“Prezes Urzędu Ochrony Danych Osobowych Mirosław Wróblewski nałożył administracyjną karę pieniężną 18 941 zł na przedsiębiorcę prowadzącego działalność gastronomiczną za niezapewnienie dostępu do wszelkich danych osobowych”
The investigation originated from a 2021 complaint regarding the processing of an employee's biometric data, likely fingerprints.
“Sprawa dotyczy skargi złożonej do Prezesa Urzędu Ochrony Danych Osobowych w 2021 r. przez osobę prywatną na nieprawidłowości w procesie przetwarzania jej danych osobowych przez przedsiębiorcę z województwa śląskiego.”
The authority found that the employer's persistent failure to respond obstructed an objective, thorough, and comprehensive review of the case.
“Uporczywy brak odpowiedzi ze strony przedsiębiorcy został uznany za przeszkodę w obiektywnym, wnikliwym i wszechstronnym rozpatrzeniu sprawy.”
In plain English
In 2021, an individual filed a complaint with the President of the Personal Data Protection Office regarding potential irregularities in personal data handling by a catering business in the Silesian Voivodeship. The matter concerned the employer processing the complainant's biometric data, specifically fingerprints. During the investigation, the authority determined that the employer was acting as a data controller and formally requested explanations regarding the legal basis, purpose, duration, and transparency of the biometric data processing. The employer failed to respond to this request as well as subsequent follow-up letters, including one sent in May 2024. In January 2025, the authority notified the business that it was initiating proceedings to impose an administrative fine for obstructing the investigation. Despite being given another opportunity to respond and provide information to determine the fine amount, the employer remained silent. The authority concluded that the persistent refusal to cooperate was intentional, causing unjustified delay and preventing a thorough review of the case. Consequently, the President of the Personal Data Protection Office imposed an administrative fine of 18 941 PLN. This decision underscores that failure to cooperate with data protection authorities carries severe financial consequences.
Inclusion does not imply wrongdoing or liability. Status reflects the latest information we have — always check the official source for current status.