Polska planuje publiczne rejestry firm naruszających zasady cyberbezpieczeństwa

Disclosure System for Non-Compliant Firms

Poland's digitalization ministry intends to establish public registers naming organizations that neglect their cybersecurity duties, according to Minister Krzysztof Gawkowski in statements released October 16 (Krzysztof Gawkowski: Będziemy ujawniać firmy, które nie wykonują obowiązków cyberbezpieczeństwa. Powstaną listy). The initiative marks a policy shift toward using public accountability as an enforcement tool alongside traditional regulatory penalties.

Healthcare Platform Investigation

The Personal Data Protection Office (UODO) is currently conducting an inspection of MyDr, a digital platform that provides medical services and manages patient health records, the minister confirmed (Krzysztof Gawkowski: Będziemy ujawniać firmy, które nie wykonują obowiązków cyberbezpieczeństwa. Powstaną listy). MyDr operates as a healthcare technology provider handling sensitive personal medical data, making it subject to stringent data protection requirements under Polish law. The investigation examines whether the platform has fulfilled its obligations to safeguard user information.

Legal Recourse for Affected Individuals

Should UODO impose administrative sanctions on companies found violating data protection rules, those harmed by security failures will gain standing to seek financial compensation through courts, Gawkowski stated (Krzysztof Gawkowski: Będziemy ujawniać firmy, które nie wykonują obowiązków cyberbezpieczeństwa. Powstaną listy). The regulatory penalties would establish grounds for both individual lawsuits and collective legal actions, creating pathways for victims to recover damages from breaches.

Enforcement Strategy

The public disclosure mechanism represents an effort to combine reputational consequences with financial sanctions to drive compliance. By making corporate failures visible, authorities seek to pressure organizations into improving their cybersecurity practices beyond what monetary penalties alone might achieve.

The policy responds to mounting concerns about digital security in sectors managing sensitive personal information, particularly healthcare providers that store patient medical histories and treatment data. Poland's approach integrates regulatory oversight with transparency requirements to strengthen national data protection standards.

Źródła

• Krzysztof Gawkowski: Będziemy ujawniać firmy, które nie wykonują obowiązków cyberbezpieczeństwa. Powstaną listy