Data Leak Compensation in Poland Likely Symbolic, Experts Say

A massive data breach from the healthcare platform MyDr has prompted widespread concern in Poland, leading many citizens to block their PESEL identification numbers. Clinics that were direct administrators of the data are reporting breaches, and the Office for Personal Data Protection has launched an investigation into the circumstances and accountability for the incident.

Amidst the fallout, reports circulating on social media suggest the possibility of significant financial compensation through legal action for those affected by the leak, with some claims reaching tens of thousands of Polish złoty. However, legal professionals specializing in data protection caution against such expectations.

According to Sławomir Kowalski, a partner at _Just_LAW, pursuing claims for a single individual often proves financially unviable due to the typically symbolic amounts awarded by Polish courts. He notes that compensation for data leaks has historically ranged from 1,000 to 3,000 złoty, which has discouraged a wave of lawsuits despite previous significant breaches.

Dr. hab. Arwid Mednis, a legal advisor at Mednis Legal and lecturer at the University of Warsaw, shares a similar perspective. He points out that Poland lacks a tradition of awarding large sums for damages, unlike in the United States. Mednis advises skepticism towards claims of substantial payouts, anticipating only symbolic compensation for non-pecuniary losses like stress and a sense of insecurity, if any compensation is awarded at all.

However, both experts acknowledge that the sensitive nature of the leaked data, personal health information, could influence court decisions. Mednis suggests that the severity of concern might vary, with information about psychiatric treatment potentially being viewed more seriously than details about more common medical consultations. Despite this, he maintains that spectacular sums are unlikely, especially considering that court costs could potentially exceed any awarded compensation, making even a legal victory a financial loss.

“

W Polsce nie ma tradycji zasądzania dużych kwot tytułem zadośćuczynienia, jak chociażby w USA. Dlatego z dystansem podchodziłbym do deklaracji prawników, którzy obiecują złote góry. Za sam wyciek danych i związane z tym straty niemajątkowe, takie jak stres czy poczucie zagrożenia raczej spodziewałbym się symbolicznej rekompensaty, o ile w ogóle sąd uzna, że jest co rekompensować.