The company disagrees with the Provincial Administrative Court’s (WSA) ruling and intends to appeal it to the Supreme Administrative Court (NSA).
Morele.net sp. z o.o. has announced its intention to appeal the ruling by the Provincial Administrative Court (WSA) in Warsaw, which on September 16, 2024, dismissed the company’s complaint against a decision by the President of the Personal Data Protection Office (UODO). The UODO’s decision concerned the 2018 cyberattack and imposed a fine of 3,819,960 PLN on Morele.net.
This penalty was levied after the Supreme Administrative Court (NSA) had previously overturned the UODO President’s 2019 decision in the same case, which had imposed a fine of 2,830,410 PLN. The NSA’s previous annulment was partly due to the lack of an objective assessment of the security measures employed by Morele.net at the time, with the NSA specifically suggesting an expert opinion as a way to meet this requirement.
However, the WSA ruled that the UODO President was not obligated to appoint an expert witness to evaluate the adequacy of the safeguards Morele.net used in 2018. The WSA stated that the supervisory authority possesses sufficient specialized knowledge to assess the company’s conduct and could therefore base its decision solely on an analysis of personal data safeguards prepared by UODO staff.
Furthermore, the WSA also rejected Morele.net’s argument that the UODO President was not authorized to impose a higher penalty than the one from the 2019 decision, despite no change in the circumstances of the case between the two decisions.
Morele.net strongly disagrees with the WSA’s verdict and plans to escalate the appeal to the Supreme Administrative Court.