[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwMcr127gtY9DETtNV-NDSI_utnbt9M5Tg0MVQTk222U":3},{"article":4,"iocs":43},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":21,"category":22,"article_tags":25},"d13cfdd4-b48a-4058-a0cd-f39ca46f0084","District Court Warsaw-Praga (Poland) - II C 1228\u002F19","district-court-warsaw-praga-poland-ii-c-1228-19-115943","← Older revision Revision as of 09:13, 24 June 2026 Line 10: Line 10: |ECLI= |ECLI= |Original_Source_Name_1= |Original_Source_Name_1=Oreczenia |Original_Source_Link_1=http:\u002F\u002Forzeczenia.ms.gov.pl\u002Fcontent\u002Frodo\u002F154510000001003_II_C_001228_2019_Uz_2022-10-14_001 |Original_Source_Link_1=http:\u002F\u002Forzeczenia.ms.gov.pl\u002Fcontent\u002Frodo\u002F154510000001003_II_C_001228_2019_Uz_2022-10-14_001 |Original_Source_Language_1=Polish |Original_Source_Language_1=Polish","The District Court in Warsaw-Praga awarded a data subject €212 for non-material damages resulting from a data breach by an electricity company. The breach occurred when an employee mistakenly emailed a file containing personal data of multiple clients, including names, addresses, and invoice numbers, to one customer. The court found the incident to be a 'personal data breach' under GDPR and awarded compensation based on Article 82 GDPR.","Polish court awards €212 in damages for GDPR data breach non-material harm.","Help District Court Warsaw-Praga (Poland) - II C 1228\u002F19: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 12:28, 31 January 2023 view sourceKk (talk | contribs)382 editsm Tag: Visual edit← Older edit Latest revision as of 09:13, 24 June 2026 view source Bms (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators116 edits Line 10: Line 10: |ECLI=|ECLI= |Original_Source_Name_1=|Original_Source_Name_1=Oreczenia |Original_Source_Link_1=http:\u002F\u002Forzeczenia.ms.gov.pl\u002Fcontent\u002Frodo\u002F154510000001003_II_C_001228_2019_Uz_2022-10-14_001|Original_Source_Link_1=http:\u002F\u002Forzeczenia.ms.gov.pl\u002Fcontent\u002Frodo\u002F154510000001003_II_C_001228_2019_Uz_2022-10-14_001 |Original_Source_Language_1=Polish|Original_Source_Language_1=Polish Latest revision as of 09:13, 24 June 2026 District Court Warsaw-Praga - II C 1228\u002F19 Court: District Court Warsaw-Praga (Poland) Jurisdiction: Poland Relevant Law: Article 4(12) GDPR Article 82(1) GDPR Decided: 17.03.2022 Published: Parties: National Case Number\u002FName: II C 1228\u002F19 European Case Law Identifier: Appeal from: Appeal to: Original Language(s): Polish Original Source: Oreczenia (in Polish) Initial Contributor: P.balkanska01 In a case against an electricity company, the District Court in Warsaw awarded a data subject €212 for non-material damages suffered as a result of a data breach. The Court applied Article 82 GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts The controller (the defendant) was an electricity company. The data subject (the plaintiff) was a customer. On 6 February 2019, due to an error, an employee of the defendant emailed to one of the company’s clients a file containing the personal data of other clients (data subjects), including the the plaintiff's. The information included: first name, surname, ID number, address, customer number, and numbers of invoices. After learning about the security breach, the defendant notified the Polish DPA of the incident. The defendant also sent a notification to the affected data subjects and asked the recipients of the unintentional disclosure the delete the file. After receiving a notice of the security breach, the plaintiff filed a complaint with the Polish DPA. Moreover, she requested the defendant to terminate her contract by mutual agreement due to the loss of confidence. The defendant stated that a one time breach of the plaintiff’s personal data did not constitute a gross breach of contract and therefore did not provide grounds for termination of the contract. Hence, the plaintiff decided to terminate the contract herself despite a financial penalty. Moreover, due to the security breach and fear that her personal data could be used by third parties, she set up a subscription account with the Credit Information Bureau to receive information on credit obligations attributed to her. On top of that, she suffered non-pecuniary harm from the stress and psychological discomfort related to the fear that her personal data could be used by third parties. Apart from the proceedings at the DPA, the plaintiff brought an action to court seeking damages for the non-material harm caused by the incident on the basis of Article 82 GDPR in the amount of PLN 20,000 (€4,247). Holding First, the District Court of Warsaw-Praga (the Court) confirmed that the incident constituted a 'personal data breach' within the meaning of Article 4(12) GDPR. It also recalled that any person who suffered material or non-material damages due to a breach of the GDPR has a right to obtain compensation from the controller or processor under Article 82(1) GDPR. Second, the Court assessed the extent of the damage suffered by the plaintiff. It considered the personal data disclosed in the security breach to be 'highly sensitive'. The Court held that the plaintiff's fear of unauthorised use of her data by third parties must be considered 'real' given the news appearing in the media space reporting the illegal use of personal data to take out loans on other persons. Third, the Court noted that after learning of the violation, the defendant took all the necessary steps in order to prevent the damage from increasing further. The actions of the defendant led to the deletion of the file with personal data from the possession of the unauthorised party, which removed any further possibility of harm. The Court concluded that apart from the fear of her personal data being used by an unauthorised third party, the plaintiff was not affected by any further consequences. Thus, the non-pecuniary damage was small and the demand for PLN 20,000 (ca. €4,247) was excessive and inadequate to the extent of the damage suffered. The Court decided that the appropriate sum to award the plaintiff for inadequate protection under the GDPR and the infringement of her right to privacy was PLN 1,000 (ca. €212). Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details. JUSTIFICATION The plaintiff B.N. filed a lawsuit against (...) Sp. z o. o. in W. (now after changing the name: (...) Sp. z o.o. in W.) at: 1. statement of infringement by the defendant company of the Plaintiff's personal data; 2. ordering the Defendant to pay the Claimant compensation in the amount of PLN 20,000.00; 3. In addition, the Claimant requested that the Defendant be ordered to pay court costs in accordance with the standards prescribed by law. By letter of December 23, 2019 Following the Court's commitment, the claimant clarified her claim by requesting: payment of compensation for non-pecuniary damage in the amount of PLN 20,000 for the violation of the Plaintiff's personal data by the Defendant. At the same time, she explained that the request contained in point 1 of the statement of claim that the Defendant violated the claimant's personal data is not a separate request (k.17). In response to the lawsuit, the Defendant requested that the claim be dismissed in its entirety and that the Claimant pay the costs of the proceedings to the Defendant (k.29). The plaintiff, replaced by a proxy, in the reply of January 28, 2021, modified the demand in such a way that instead of the compensation indicated in the lawsuit in the amount of PLN 20,000.00, she requested compensation in the amount of PLN 20,000.00 and also requested that the costs of the trial be awarded ( k.62). By order of March 1, 2021, the Court ordered the return of the modified statement of claim due to formal deficiencies in the form of a lack of a copy of the modified statement of claim for the opposing party (k.67). In the pleading of March 15, 2021, the Plaintiff modified the claim in such a way that instead of the compensation indicated in the lawsuit in the amount of PLN 20,000.00, she requested compensation in the amount of PLN 20,000.00 and also requested the award of the costs of the trial (k.77). In final statements, at the hearing on March 3, 2022, the plaintiff upheld the claim, while the defendant applied for its dismissal. The court established the following facts: The defendant (...) Sp. z o. o. in W. (current name (...) Sp. z o.o. in W.) sold electricity to the Plaintiff B.N. from autumn 2018 to the Plaintiff's property. (evidence: k. 13, e-mail correspondence, k.14 letter (...) sp. z o.o. of August 14, 2019, k.199-200 evidence from the hearing of the plaintiff B.N., k.49-51 copy of the National Court Register; k.195-198 full excerpt from the National Court Register) On February 6, 2019, an employee of the Defendant company, as a result of an error, sent to one of the company's clients - (...), by e-mail a file with an attachment - a financial document containing the personal data of other clients, including the person","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=District_Court_Warsaw-Praga_(Poland)_-_II_C_1228\u002F19&diff=51981&oldid=30849","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-06-24T09:13:07+00:00","2026-06-24T10:00:13.856115+00:00",7,[18],{"name":19,"type":20},"GDPR","product","3f0f8451-91df-4b6c-9a73-ef3b2509b7f1",{"id":21,"icon":23,"name":19,"slug":24},null,"gdpr",[26,31,33,38],{"category":27},{"id":28,"icon":23,"name":29,"slug":30},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":32},{"id":21,"icon":23,"name":19,"slug":24},{"category":34},{"id":35,"icon":23,"name":36,"slug":37},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":39},{"id":40,"icon":23,"name":41,"slug":42},"d95477d7-eb04-4fad-a2dc-be1428040ce7","Privacy Fines","privacy-fines",[]]