An inspection by the President of the Personal Data Protection Office is not equivalent to a fine

The purpose of inspections conducted by the Personal Data Protection Office at public authorities obliged to publish information in the Public Information Bulletin (BIP) is to improve the quality of personal data protection.

Recently, media reports have suggested that the sectoral inspections planned by the President of the Personal Data Protection Office, which this year will cover entities operating the Public Information Bulletin, may result in high administrative fines and undermine the transparency of the activities of local government authorities.

The obligation to anonymise documents published in the BIP is nothing new. In the past, the Personal Data Protection Office has already inspected BIPs in local government units. Those inspections showed that excessive, outdated, and sometimes inaccurate data were often disclosed in the BIP, which had a negative impact on the individuals concerned.

As a result of those inspections, the approach to protecting data processed in the BIP changed. Many local governments developed and implemented appropriate data protection policies and began conducting systematic reviews. The actions of the Personal Data Protection Office made many entities aware, among other things, that asset declarations do not have to be stored in BIPs indefinitely.

Data are still not properly protected everywhere, as confirmed by numerous complaints, reports, and personal data breach notifications submitted by controllers. Therefore, the President of the Personal Data Protection Office has decided to examine how various public entities - not only local governments - approach personal data protection in the Public Information Bulletin.

The President of the Personal Data Protection Office resorts to fines only in exceptional situations, as confirmed by statistics. In 2025, the President of the Personal Data Protection Office issued over 2,000 administrative decisions, including 32 decisions imposing fines. This means that fines were imposed in just over 1.5% of cases concluded with an administrative decision.

The President of the Personal Data Protection Office has already issued decisions concerning the failure to anonymise certain documents on BIP websites, and these were not decisions imposing administrative fines.

The supervisory authority has a wide range of measures at its disposal to strengthen the protection of citizens’ personal data. In the event of a breach of the law, it may, among other things, issue a warning, a reprimand, or an order to bring specific actions into compliance with applicable regulations. Fines may also be imposed, but they are a last resort. The supervisory authority’s primary objective is to restore compliance on the part of the controller.

Some media outlets, when reporting on this year’s sectoral inspections conducted by the Personal Data Protection Office, refer to the PLN 40,000 fine imposed by the President of the Personal Data Protection Office on the Mayor of Aleksandrów Kujawski in 2019. Contrary to popular belief, the reason for the fine was not the publication of recordings of the municipal council sessions on YouTube. There were several reasons for imposing the fine:

• The Mayor of Aleksandrów did not conclude data processing agreements with the entities to whom personal data were transferred.
• There were no internal procedures for reviewing resources available in the BIP to determine the appropriate publication period (the BIP included, among other things, asset declarations stored longer than permitted by law - over six years).
• No risk analysis was conducted regarding the Mayor’s use of the YouTube channel and the storage of City Council session recordings exclusively on the service provider’s servers - no backup copies were maintained.

The purpose of sectoral inspections conducted by the President of the Personal Data Protection Office is always to improve the quality of personal data protection and to verify compliance with applicable law. If irregularities are detected, the most important objective is to ensure the safety of the individuals concerned and to restore compliance with the law.