Poland fines McDonald’s over employee data breach
Poland’s data protection authority issued significant penalties against McDonald’s, reaching around €3.93 million. The case stems from a data breach that exposed extensive personal information about employees through misconfigured servers.
The scheduling system, managed by an external supplier, 24/7 Communication, included employee names, ID and passport numbers, work hours, locations, job roles, and time-off details. Due to poor security controls and failure to conduct required risk assessments, database copies were left accessible in publicly searchable directories. The regulator found that McDonald’s relied entirely on the processor for security, violating basic GDPR accountability principles.
The authority also criticized the companies for lacking proper oversight and having weak contractual terms that failed to define responsibilities. The penalties reflect both the scale of the data exposed and the companies' failure to manage risk effectively. This case underlines the importance of strong data processor controls and shared responsibility under GDPR.
