The Polish Data Protection Authority (UODO) fined Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A EUR 18,930 for a breach under Art. 33 (1) GDPR and Art. 34 (1) GDPR. Back in May 2020, the Polish DPA was notified by a third party that a data breach occurred at Towarzystwo Ubezpieczeń i Reasekuracji WARTA S.A, regarding an insurance agent posing as a processing agent at the company. The insurance agent sent an insurance policy to an unauthorized third party via e-mail. The document contained personal data regarding the subject of the insurance policy, including first names, surnames, residential addresses, and other information. Then, the supervisory authority demanded that the company clarify whether it performed any risk analyses on the data security of natural persons, in connection to the electronic correspondence sent to an unauthorized third party, as this would make it evident that a data breach had occurred. If a data breach does occur, the company responsible is obligated to notify both the DPA and the affected parties. Despite being sent a letter by the supervisory authority asking for explanations on the data breach, the responsible party did nothing to report the data breach to the DPA or inform the affected data subjects about the data breach. Finally, the DPA initiated administrative proceedings, which eventually prompted the company to report the data breach and notify the two affected individuals about the incident.
the polish data protection authority uodo  towarzystwo ubezpieczeń i reasekuracji warta sa  for a breach under    and    back in may the polish dpa was notified by a third party that a data breach occurred at towarzystwo ubezpieczeń i reasekuracji warta sa regarding an insurance agent posing as a processing agent at the company the insurance agent sent an insurance policy to an unauthorized third party via email the document contained personal data regarding the subject of the insurance policy including first names surnames residential addresses and other information then the supervisory authority demanded that the company clarify whether it performed any risk analyses on the data security of natural persons in connection to the electronic correspondence sent to an unauthorized third party as this would make it evident that a data breach had occurred if a data breach does occur the company responsible is obligated to notify both the dpa and the affected parties despite being sent a letter by the supervisory authority asking for explanations on the data breach the responsible party did nothing to report the data breach to the dpa or inform the affected data subjects about the data breach finally the dpa initiated administrative proceedings which eventually prompted the company to report the data breach and notify the two affected individuals about the incident
 polish data protection authority uodo  towarzystwo ubezpieczeń  reasekuracji warta sa    breach         back  may  polish dpa  notify   third party   data breach occur  towarzystwo ubezpieczeń  reasekuracji warta sa regard  insurance agent pose   process agent   company  insurance agent send  insurance policy   unauthorized third party via email  document contain personal data regard  subject   insurance policy include first name surnames residential address   information   supervisory authority demand   company clarify whether  perform  risk analyse   data security  natural persons  connection   electronic correspondence send   unauthorized third party   would make  evident   data breach  occur   data breach  occur  company responsible  obligate  notify   dpa   affect party despite  send  letter   supervisory authority ask  explanations   data breach  responsible party  nothing  report  data breach   dpa  inform  affect data subject   data breach finally  dpa initiate administrative proceed  eventually prompt  company  report  data breach  notify  two affect individuals   incident