“the supplier ran it, so the breach is theirs”

The belief above is a common one, stated here in our words. It is not a quotation from the company.

McDonald’s Polska outsourced a staff scheduling module to an outside company that had been doing its public relations work. A server misconfiguration under the processor’s responsibility put a copy of the database in a public directory. It held names, PESEL national ID numbers or passport numbers, restaurant numbers and working hours for staff of McDonald’s and its franchisees.

UODO’s published summary names these failures, on both sides:

• No risk analysis by either company, and no measures matching the scale of processing.
• No verification of the processor. According to UODO, McDonald’s relied on earlier PR work.
• No supervision. The audit and inspection terms in the contract were not used.
• No testing of whether the measures worked.
• A missing subprocessor contract, signed only after the breach.
• The data protection officer left out of choosing the processor.

The processor did not treat the module as a resource it was responsible for. UODO said the duty comes from the law and cannot be excluded by how a contract is read.

The figures are three fines totalling PLN 16,932,657 on McDonald’s Polska, plus a reprimand, and three totalling PLN 183,858 on the processor, 24/7 Communication. This page rests on UODO’s summary. Check for any court challenge before citing the amounts as final.

The processor here was not a large cloud provider. It was an existing partner given a job outside what it had been hired for. Look for that pattern in your own supplier list.