On 3 September 2020, the Voivodeship Administrative Court (WSA) in Warsaw issued a judgment on Morele.net’s appeal against the decision of the President of the Personal Data Protection Office (UODO) imposing an administrative fine. The WSA dismissed the appeal and considered that the decision on the fine imposed on the company was justified.
The WSA dealt with Morele.net’s appeal regarding, inter alia, insufficient use of technical and organisational measures to safeguard the data of its customers, the result of which was unauthorised access to customers’ personal data.
The appeal concerned the decision of the President of the UODO of 10 September 2019, which stated that the company by failing to use sufficient technical data protection measures infringed the provisions of the GDPR, and hence the President of the UODO imposed a fine on Morele.net in the amount of PLN 2.8 million.
The Court shared the position of the supervisory authority that the technical and organisational measures applied by the company proved to be ineffective for the purpose of protecting the personal data of customers, including a one-stage authorisation to the employee’s panel. The Court also confirmed the UODO’s argument that the company had insufficiently monitored the potential risks to the rights and freedoms of the persons whose data were processed by this entity.
When dismissing the appeal, the Court found that the decision of the President of the UODO meets the requirements of the decision under the Administrative Procedure Code, and that the applicant’s allegations concerning infringement of its rights, including restriction of the right of the defence, do not deserve to be taken into account. According to the Court, the operative part of the decision indicates which provisions have been infringed. The Court had no doubt as for what infringements the fine was imposed.
Furthermore, the WSA stated that the supervisory authority had correctly assessed the facts in the case concerned and considered that the fine imposed was high but within the limits of the law and justified by circumstances. According to the Court, the supervisory authority correctly took into account the aggravating and mitigating factors.
