Fine for failure to co-operate with the Polish Personal Data Protection Office during an inspection

In his recent decision the President of the Personal Data Protection Office (UODO) has imposed a fine of PLN 20,000 (the equivalent of EUR 4.673,56) on the telemarketing company - Vis Consulting Sp. z o.o. (Company) - for its failure to cooperate with the supervisory authority during the inspection. The infringement consisted in making it impossible for the UODO to carry out the inspection concerning the compliance with the provisions of the GDPR by failure to give access to the Company's premises and to the personal data processed by it.

Facts of the case

• The UODO notified the Company of the date and scope of the planned inspection. The inspection was to be additionally used to assess the evidence gathered as part of another inspection conducted by the UODO in respect of an entity to which the Company provided the telemarketing services. The inspection was to be carried out in accordance with the inspection plan announced for 2019, covering the activities of the entities operating in the telemarketing sector.
• On the set date, the inspectors did not find any person representing the Company in the Company’s premises. The premises located at the address recorded in the National Court Register turned out to be a "virtual office" subleased by the Company. The inspectors went to the Company's registered office for the second time and again did not find any representative of the Company in the premises. The Company informed the UODO that the inspection could not take place
• Based on the information entered into the National Court Register, the authority established that the Company adopted a resolution on its dissolution and liquidation.
• In addition to and independently of the administrative proceedings initiated by the UODO against the Company, the UODO informed the competent prosecutor's office about the suspicion of an offence having been committed consisting in the Company making it impossible for the supervisory authority to carry out the inspection. The decision contained information to the effect that the prosecutor's office had sent a bill of indictment to the accused as part of the criminal proceedings.

Allegation regarding failure to co-operate with the UODO

The allegation made by the UODO against the Company - which determined that a fine would be imposed - was a failure to co-operate with the authority during the inspection. The UODO emphasised that the following facts indicate the failure to co-operate:

• once the Company learnt about the planned inspection, it sent a request to the lessor to terminate the lease agreement for commercial premises,
• the Company twice made it impossible to carry out inspection,
• the Company adopted a resolution on its dissolution and on the commencement of liquidation proceedings.

Circumstances considered by the UODO

• The UODO recognised that in this case the Company’s failure to co-operate with the authority is an infringement of a substantial gravity and serious nature, as it prevented the authority from carrying out the inspection. Moreover, the infringement restricted the UODO in fully evaluating the evidence collected in the course of the inspection carried out at another entity – a client of the Company.
• The UODO also emphasised that an important aggravating circumstance was the deliberate nature of the infringement. In the UODO’s opinion, the fact that the inspection tasks were intentionally frustrated may indicate that the Company is not fulfilling its personal data processing obligations.
• The UODO did not take any mitigating circumstances into consideration. It is not entirely clear what the reasoning was for this approach by the UODO. For example, it does not follow from the decision whether the Company had been earlier penalised for an infringement of personal data protection regulations, whereas an absence of prior infringements could have constituted a mitigating circumstance.

Take-aways

• The failure to co-operate with the UODO during the inspection may, in itself, constitute an allegation leading the UODO to impose an administrative fine in the amount provided for by the provisions of the GDPR.
• Impeding or frustrating an inspection is subject to criminal liability.
• Businesses operating in sectors covered by the UODO’s inspection plan for a given year should pay particular attention to ensuring compliance with personal data protection regulations.