Energa-Obrót Reprimanded by UODO Over WhatsApp Data Breach

Poland’s Personal Data Protection Office (UODO) has issued a formal reprimand to Energa-Obrót after sales agents improperly processed customer contract scans and sensitive information via the WhatsApp messaging application.

Regulatory Enforcement and Penalties

UODO President Mirosław Wróblewski issued the reprimand following an investigation into data protection violations. In addition to the warning for Energa-Obrót, a cooperating entity involved in the illicit processing was fined approximately 10,145 PLN.

Systemic Failures in Oversight

The investigation revealed that Energa-Obrót, acting as the data administrator, failed to implement adequate technical and organizational security measures. The company also neglected to properly verify whether its contracted processors provided sufficient guarantees for secure data handling.

The 2021 WhatsApp Data Leak

The incident dates back to 2021, when business partners visited homes to propose contract amendments. The company self-reported the breach after discovering that a former sales representative and associates had used WhatsApp for months to transmit customer documents, including scans of contracts for at least 15 clients.

Unauthorized Processing and Accountability

The investigation confirmed that some data was transmitted outside the European Economic Area. While Energa-Obrót self-reported the internal findings, the external processor attempted to minimize its role and shift responsibility to other parties during the UODO proceedings.