Poland's data protection authority fined a door-to-door sales partner of Energa-Obrot for letting reps trade customer contract scans over personal WhatsApp with no oversight.
Why It Matters
The decision, published 22 June 2026, targeted a business partner running field sales for the energy company: representatives used personal phones and WhatsApp to pass around scanned ID documents and signed contracts, with no approved tool, no device policy, and no data processing agreement covering the practice. The fine itself was modest, 10,145 zloty, but it confirms UODO will chase the unauthorized channel, not just the underlying breach.
What To Do About It
If field staff, sales reps or subcontractors handle client documents on personal phones, check what app they actually use to send them. Put an approved tool and a written data processing agreement in place with anyone outside the company who touches that data, before an audit finds the gap for you.
Related Signals
Sąd potwierdził karę prawie 52 tys.
31 Aug 2026
Norweski regulator ochrony danych nakazał sieci siłowni SATS zaniechać obowiązkowego fotografowania klientów przy wejściu -- zdjęcie nie było warunkiem koniecznym umowy członkowskiej.
28 Aug 2026
Wyciek z platformy MyDr ujawnił dane niemal 19 mln pacjentów -- kary grożą nie tylko dostawcy oprogramowania, ale każdej z około 12 tys.
28 Aug 2026