It is undisputed that in the situation described by us, a breach has occurred. The lost letter or package not only contained personal data on the label (name, surname, and address), but also, through it, we transmitted, for example, documents concerning an employee or client, often very important ones. Consequently, the availability of the data has been compromised (the data carrier has been lost, often the only one), and often their confidentiality as well (after all, we do not know whether unauthorized persons have accessed the contents of the letter/package).
Therefore, the million-dollar question is: who should report the breach to the President of the Polish DPA – the sender or Poczta Polska or the courier?
The answer from the President of the Polish DPA may be shocking to you: in the case of a lost postal/courier shipment, the obligations related to reporting the breach rest with the sender of the shipment, as they possess knowledge of what data is being transmitted in the shipment, and thus can assess what risk the loss of the shipment poses to the rights and freedoms of the individual.
What does this mean? From your perspective, it means only one, but very important thing: report such situations to your supervisor or directly to the Data Protection Officer (DPO). Based on the information you provide, the data controller will decide whether the lost documents are significant enough for the individual concerned that the President of the Polish DPA and the intended recipient should be informed of the incident, or if nothing needs to be done and it is sufficient to record this fact in the internal GDPR documentation.
We know that reading our message may not be satisfying for you, which is why we have something to comfort you. In the event that only the return receipt is lost, the entity obliged to assess the consequences of such an event is the postal operator.
If you have any questions regarding the issue we have described, please write to us; we are at your disposal.
