When processing data, it is necessary to assess the risk

Last year, the Personal Data Protection Office published information on its website about the punishment of two companies from the medical sector for violations of personal data protection. In both cases, hacker attacks occurred, but relatively little attention was paid to their root causes, i.e. inadequate risk assessment in the processing of personal data.

The first case concerned the company American Heart of Poland SA, which was fined 330,000 euros. As a result of the hacking attack, unauthorized persons gained access to detailed personal data of approximately 21,000 people. The UODO found that the company had not conducted a proper risk analysis, which led to a lack of appropriate technical and organizational measures to protect the processed data. The breached data included, among others, names, surnames, PESEL numbers, health data and information on earnings.