Administrative fine imposed for failure to ensure the independence of a Data Protection Officer

For five years, a bailiff performed the role of data protection officer (DPO) in his own office. In doing so, he infringed the requirement to ensure the independence of the DPO. Furthermore, he failed to notify the President of the Personal Data Protection Office of the designation of DPO. For these two infringements of the GDPR, the President of the Personal Data Protection Office, Mirosław Wróblewski, imposed an administrative fine totalling PLN 15 500.

The case arose following the receipt by the President of the Personal Data Protection Office of a personal data breach notification submitted by the controller, concerning an incident in which a notice of attachment of a bank account had been sent to a person who was not its intended recipient.

During the examination of the notification form, it emerged that the bailiff, acting as the controller, was also performing the role of DPO within his own organisation, on the assumption that such an arrangement would not give rise to a conflict of interests. Furthermore, having designated himself as the DPO, the bailiff had failed to fulfil his obligation to notify the supervisory authority of that designation.

The failure to fulfil the notification obligation, together with concerns regarding the proper designation of the DPO, prompted the President of the Personal Data Protection Office to initiate administrative proceedings. The findings of those proceedings confirmed infringements of data protection legislation. The President of the Personal Data Protection Office has repeatedly emphasised the importance of the role performed by the DPO. The DPO is designated to support the controller and the processor in ensuring that the processing of personal data complies with applicable law. The relevant provisions also require the controller or processor to publish the contact details of the designated DPO and communicate those details to the President of the Personal Data Protection Office.

The designation of the controller himself as the DPO was contrary to the applicable provisions. In this case, the bailiff performed both roles within his own organisation. Although a DPO may fulfil other tasks and duties, this is permissible only where the controller or processor ensures that such tasks and duties do not result in a conflict of interests. The DPO's tasks include, among other things, informing the controller of its obligations and monitoring compliance with data protection legislation. Where both roles are performed by the same person, the DPO would effectively be raising any concerns with the controller – in other words, with himself.

A conflict of interests in the performance of DPO’s duties may arise, among other things, where the DPO simultaneously performs two roles within an organisation or undertakes actions or makes decisions that are subsequently subject to his or her own assessment pursuant to Article 39(1)(b) GDPR.

In its previous positions, the President of the Personal Data Protection Office has repeatedly addressed the issue of conflicts of interests involving persons performing the role of DPO, as well as the permissibility of combining the DPO role with other positions. In this regard, the supervisory authority has expressly stated that: "It is not permissible to designate as a DPO a person who manages an entity acting as a controller or processor, such as a member of the management board of an association, a school headteacher, a municipal mayor or a member of a company's management board. Adopting a different approach would lead to situations in which the DPO would be assessing and monitoring his or her own compliance with data protection legislation."

The President of the Personal Data Protection Office imposed administrative fines totalling PLN 15 500. He considered that, in this case, issuing a reprimand would be disproportionate to the infringements of data protection legislation identified. The controller was fined PLN 3 500 for failing to notify the supervisory authority of the designation of a DPO within 14 days of that designation. Furthermore, having taken mitigating circumstances into account, the supervisory authority also decided to impose a fine of PLN 12 000 for failing to ensure that the DPO enjoyed a status guaranteeing independence in the performance of his tasks and duties.

As a public official and a professional, a bailiff is subject to a particularly high standard of diligence in complying with data protection legislation. In the present case, the controller made a deliberate decision that was neither the result of an error nor attributable to negligence. The failure to ensure the independence of the DPO was intended to generate tangible financial savings for the controller at the expense of safeguards for the protection of personal data. In the opinion of the President of the Personal Data Protection Office, the administrative fine imposed will encourage the controller to make every effort to ensure the genuine independence of the DPO, thereby helping to prevent potential future sanctions for infringements of the GDPR.

Decision in Polish: DKN.5131.24.2025