Polish Bailiff Fined for DPO Conflict of Interest and Missing Contact Details
A court bailiff in Poland was fined €3,500 by UODO for two distinct GDPR violations: failing to publish and register the Data Protection Officer's contact details with the supervisory authority, and appointing themselves as their own DPO — a fundamental conflict of interest that undermines the independence the role requires. The DPO is designed to act as an independent overseer of data protection practices, and when the controller and DPO are the same person, that oversight becomes meaningless. This case highlights that GDPR compliance is not merely about technical safeguards but also about governance structures and administrative obligations. Even smaller organisations and individuals processing personal data professionally must meet these structural requirements or face regulatory sanctions.
Tactical Insight
Immediate actions
- Audit your organisation's DPO appointment to confirm the individual is independent and free from conflicts of interest with their primary role.
- Ensure the DPO's name and contact details are published on your organisation's website and formally registered with your national supervisory authority.
Governance & structural improvements
- Establish a clear separation of duties policy that prevents any single individual from simultaneously holding a data controller/processor role and the DPO role.
- Document the DPO appointment formally, including a written mandate that defines their independence, responsibilities, and reporting lines.
- Schedule an annual GDPR compliance review covering all mandatory administrative obligations (DPO registration, privacy notices, ROPA updates).
Training & awareness measures
- Provide targeted GDPR training for leadership and legal staff covering DPO eligibility criteria and the conflict-of-interest prohibition under Article 38(6).
- Engage external DPO services or consultants if internal resources cannot provide a sufficiently independent appointment.