Customer data security

The ENEA Group respects the privacy of its customers and protects the security of the data it stores, guided by the applicable laws and internal procedures in this area. As regards personal data security, the Group relies on ENEA Centrum, which ensures comprehensive support for IT processes, including administration of systems critical for cybersecurity. ENEA Group companies comply with the requirements of the GDPR and the key service operators act in accordance with the Act on the National Cybersecurity System. The Group has implemented advanced technical and organizational solutions enabling a quick and efficient management of cybersecurity incidents. The established structures counteract the potential materialization of risks, with a particular focus on the existing threats generated in connection with the necessity to adapt the security of ICT and industrial automation systems to the hybrid performance of work and the related threats arising from the present geopolitical situation in the world.

Pursuant to the GDPR requirements, Data Protection Officers have been appointed in Group companies. They monitor compliance with personal data protection regulations and are contact persons for any matters in that area, also for customers.

Moreover, the companies adopt their own regulations, an example of which is the Information Security Policy for ICT Systems at Lubelski Węgiel Bogdanka S.A.

Both employees and external entities cooperating with the Group companies sign non-disclosure agreements (or confidentiality clauses) and personal data processing agreements. Employees’ access to customers’ personal data is limited to a necessary extent resulting from the discharged functions; physical access to rooms where documents with personal data are stored is also restricted. Documents which include personal data sent by electronic mail are password-protected and in the case of traditional mail, they are sent by registered letter with receipt confirmation. IT systems processing personal data operate only in internal networks such as intranet (without access to the Internet) and have necessary safeguards to protect the data.

In 2022, the physical, information and ICT security services focused primarily on the process of improving employee skills in the area of the broadly defined security. The employees attended dedicated external and internal training. Furthermore, internal security campaigns for raising employee awareness of phishing attacks were launched last year.

On 21 February 2022, the Voivodship Administrative Court upheld the decision of the President of the Personal Data Protection Authority, who – by the decision of 11 February 2021 – imposed an administrative fine of PLN 136,437 on ENEA S.A. in connection with finding a breach of Article 33(1) of Regulation 2016/679 consisting in a failure to report a personal data breach to the President of the Personal Data Protection Authority without undue delay, within 72 hours of finding the breach. The fine was paid on 15 March 2022.