POLISH NEWS | Miłosz Manasterski: Two weeks after the disclosure of the attack on MyDr, which according to government figures may have exposed the data of almost nineteen million Poles, the government wanted to build another vast collection — this time of national identity numbers, photographs, grades and attendance records belonging to schoolchildren. President Karol Nawrocki refused to sign. Can a state that still cannot tell its citizens whether their records were in the breach be trusted to assemble a database that large about Polish children?
Table of Contents
Everything Under One Roof
The Ptolemies had an idea that still looks like genius: to gather in a single institution the fullest possible collection of the knowledge of their age. According to later accounts, every ship entering the harbour at Alexandria was searched, and any scrolls found aboard were sent to the scriptorium — the owner was handed a copy, the original stayed in the library. Callimachus catalogued the collection in a hundred and twenty volumes, and for several generations Alexandria was the place where humanity genuinely knew what it knew.
Then the library vanished. Not in a single night and not in a single fire — first the blaze in the harbour under Caesar, then wars, budget cuts and the indifference of successive rulers. The perfect collection turned out to be a fragile one, because its value and its weakness had the same source: everything was in one place. Twenty-three centuries later the same temptation returns, with one difference. Today a collection needs no building, only a server. And a server, unlike a scroll, can be robbed remotely, wholesale and without witnesses.
A Lesson from a Fortnight Ago
On 12 August, Deputy Prime Minister Krzysztof Gawkowski announced an attack on MyDr, software used by some twelve thousand medical facilities. The Ministry of Digital Affairs spoke of a stolen database exceeding two terabytes and of records belonging to almost nineteen million patients: PESEL identity numbers, information on medicines, prescriptions, appointments and medical documentation. The company itself, in a statement of 14 August, was more guarded, referring to „archival resources, mainly from 2024 and earlier years”. The investigation is being run by the Central Bureau for Combating Cybercrime under the supervision of the Warsaw Regional Prosecutor’s Office, and the data protection authority has opened its own inquiry.
The most concrete piece of advice the state had for the citizen at that moment was this: freeze your PESEL number in the mObywatel app. It is hard to argue with the suggestion, except that the hygiene is being demanded of the person who was spilled on, not of the one who did the spilling. On 18 August the company was still only „at the final stage of establishing” the scope of the incident, and investigators were still establishing the circumstances. The government’s own breach-checking portal did not yet carry the MyDr data at the time.
Gawkowski called it one of the largest incidents in Polish history and promised the perpetrators would be pursued without mercy. They probably will be. But data, once taken out, does not come back. If a diagnosis from ten years ago was among the records, it cannot be cancelled like a payment card, and no one can guarantee that every copy has disappeared.
From Morele to MyDr
Anyone treating this as an isolated mishap has not been reading the chronicle of recent years. In 2019 the data protection authority imposed what was then a record fine on the online retailer Morele.net for losing the data of more than two million customers; the case then wound through the courts for years. In November 2023 ransomware paralysed ALAB Laboratoria, and test results belonging to tens of thousands of patients from the years 2017 to 2023 appeared online, complete with names, identity numbers and addresses. Further batches followed in the months after, including employee records. The company refused to pay the ransom, so the price was paid by people who had never heard of any ransom.
Four months earlier, in July 2023, the target was more serious. The attack on the War Studies University — the institution that trains Poland’s future commanders — did not merely exfiltrate data, it destroyed it in place, because the attackers used software that wipes the contents of disks. They published fragments of lists with names and positions, and for weeks the damage could not be undone: staff had no access to their own computers or work email. An external service provider was identified as a factor — and that is the only thing the case has in common with MyDr, because the mechanism of the attack was different.
The cumulative effect shows up in the numbers, and this is the saddest part of the story. In an August survey by BGR Quantic, conducted online among 1,073 adult Poles, 81.9 per cent had heard about the breach. Some 57.2 per cent took none of the protective steps on offer. Only 2.6 per cent froze their identity number, and just one respondent in five knew precisely where to check whether their data had leaked. This is not laziness. It is the resignation of a citizen who long ago stopped believing he has any control over what the state and private companies know about him.
And it is at precisely this moment that he is being offered yet another register. In digital government, trust is not a soft addition to the project but its foundation; without it, all that remains is compulsion. After weeks of headlines about the breach, 2.6 per cent of respondents froze their identity number. And in that same moment the government wants to persuade parents that their children’s data will be safe in a new central system.
Two Hundred and Sixteen Million, and a Question of Proportion
The education ministry had been preparing a pilot of the state eDziennik: a start on 22 September in at least eighteen schools, with the system opening to other interested schools from September 2027. Participation was to be voluntary. The cost of building and running it for ten years was estimated at 216.5 million złoty, roughly fifty million euros. The Ministry of Digital Affairs and the Central IT Centre are building it, and access is to run through mObywatel, the state’s citizen app.
The ministry’s arguments deserve to be stated in their strongest form. Parents gain free access to functions for which some providers currently charge, and without advertising. Schools gain integration with the national School Information System and less manual re-entry of the same data. A pupil who changes school mid-year does not start from scratch. These are real benefits and there is no sense pretending otherwise. The question is whether their scale justifies building a central system covering so broad a catalogue of information about children.
And the catalogue is broad. The system was to process, among other things, identity numbers, photographs and addresses of pupils, their grades, lesson topics, attendance and reasons for absence, information on individual needs arising from recommendations in formal assessments and opinions, and parents’ contact details. The Association of Polish Counties argued that this violates the principle of data minimisation. The Polish Chamber of Information Technology pointed out that the state would be acting simultaneously as the regulator of a market and as a player in it.
Not every one of these items is formally a special category of data under the GDPR. But some of them may reveal health, educational needs or religious belief — attendance at religion lessons allows inferences about a child’s faith, and exemption from physical education about a child’s health. And all of them concern minors, who decide none of this for themselves.
Yes to the mID, No to the Digital Satchel
National registers make sense when they make a citizen’s life easier. That is why Poles value the mID, the digital identity document that no longer has to be carried in a wallet, and the e-prescription, which no longer requires a trip to the clinic. These are solutions that give the citizen something back in exchange for his data. The digital satchel gives back a great deal less — it moves a pupil’s records from a dispersed market of private systems into one state system. Rather as in the harbour at Alexandria: the original stays in the collection, and the owner is handed a copy, today called a view in an app.
Supporters of the bill reply that pupils’ data already sits in the hands of private companies, and that breaches have happened there too. The argument is honest and it is correct. Centralisation in itself need not mean weaker protection — a single standard, proper auditing and a professional security team can be stronger than a dozen solutions of uneven quality. But it carries a price: it widens the reach of the consequences of one successful break-in. Every flaw in such a system’s defences costs incomparably more. That is exactly what August’s MyDr story is about — one piece of software, twelve thousand facilities, two terabytes of data.
Senator Kazimierz Wiatr of Law and Justice made this point in the upper house. A computer scientist and former director of a supercomputing centre, he warned about the risk of a breach in a system with fifteen million users. The Central IT Centre replied that its systems, including mObywatel with twelve million users, had recorded no unauthorised access. That is true, and there is no reason to doubt it. But mObywatel is a wallet for documents we carry with us anyway, while the eDziennik is meant to be an archive of a child’s entire passage through school. Both are measured by the same standard of security. Losing them costs entirely different things.
Who Exactly Is the Lobbyist Here?
The President vetoed the bill on 28 August, and he began with a caveat: „the very idea of introducing digital solutions in the form of the eDziennik is right and should be pursued”. What he challenged was the way the education ministry approached the rollout, and he set out three problems. The first is the safety of children: the act provides for a central system holding sensitive pupil data — identity numbers, photographs, grades, attendance and information about special educational needs. „If we are creating such an enormous database, its security must be an absolute priority. Yet the act does not offer sufficient guarantees regarding the protection of this information and access to it,” Nawrocki said.
The second problem is cost. More than two hundred million złoty of public money requires justification: „The state must be able to demonstrate clearly that such expenditure is necessary and rational.” The third is organisational chaos — the pilot was starting very quickly, and teachers had been pointing out that schools need time, training and preparation. That charge is not invented. The Polish Teachers’ Union demanded deeper consultation and warned about running two sets of records in parallel during the pilot, while the education section of Solidarity appealed to the President outright on 17 August to veto the bill, demanding among other things a narrower range of processed data and voluntary participation for schools.
It is worth remembering how this legislation passed through parliament. At the third reading on 31 July, 251 deputies voted in favour, 24 against and 168 abstained. The only caucus consistently opposed was Konfederacja; most Law and Justice deputies abstained, and the Senate passed the bill without amendment. The veto is therefore not a continuation of a parliamentary war, but a response to a law that went through the lower house with almost no resistance.
Education Minister Barbara Nowacka called the decision a „lobbyist’s veto”, and her deputy Katarzyna Lubnauer said it carried a very concrete price that parents and children would pay. The difficulty is that the veto was also supported by Marcin Józefaciuk, an independent deputy elected on the Civic Coalition list and a practising teacher, who said he had himself asked the President to reject the bill. His objections concerned above all an unfinished system, the pace of testing on real pupils’ data, and cost. Is he a lobbyist too?
After the veto the President said plainly what the official statement had left out: „I am not against the eDziennik,” „the whole system is badly prepared,” „fix this law, send it to me, and then I will sign it.” What he objected to above all was making children, parents and teachers the testers of an unfinished product, and he recalled the animal protection act that he first vetoed in 2025 and signed once it had been amended.
The conditions he set the government are, in any case, disarmingly modest: „consultation with teachers and experts, genuine protection of children’s data, and reasonable and transparent costs”. It would be hard to draw up a less revolutionary list. If meeting those three conditions is too high a price for the education ministry, then the veto is not the problem.
Instead of closing the case from two weeks ago, another perfect collection is being built for us — this time of identity numbers and photographs of Polish children. The Ptolemies at least had a clear purpose and made no secret of it: they wanted to hold everything humanity had managed to write down. Our collection has an unclear purpose, a clear cost and a still clearer risk. There is only one difference, and it is decisive. When scrolls burned in the harbour at Alexandria, everyone could see the smoke. Data is carried out quietly, and a copy leaves no ashes — we learn of the loss only when somebody graciously informs us. Or two weeks later, while the scope of the incident is still being established.
Miłosz Manasterski
Miłosz Manasterski is a Polish journalist and commentator writing on Central Europe, demography, family policy, religion, public institutions, and the political economy of European societies.
He is CEO of Agencja Informacyjna, an independent Polish news agency, and a regular commentator on Telewizja Republika, one of Poland’s leading news channels. He reported from the Gulf as a Middle East correspondent based in the United Arab Emirates, and from 2018 to 2023 appeared as a social and political commentator on Polish Television and Polish Radio.
His work examines how demographic change, family, religion and institutions shape the long-term future of Europe, with particular attention to the experience of Central and Eastern Europe.
He is a recipient of the Knight’s Cross of the Order of Polonia Restituta for distinguished contributions to culture and public service, and was awarded a medal under the UN Economic and Social Council (ECOSOC) framework for his work on social policy.
Polish NEWS / Opinion / Miłosz Manasterski / Source: Agencja Informacyjna / 31.08.2028
