How a platform from Poznań avoided a 43,000 PLN fine from the board of education
In mid-September 2024, the head of an EdTech platform from Poznań called us. His voice was trembling because he had just received a protocol from the board of education with a calculated penalty of 43,185 zlotys for alleged errors in the student login system.
An inspection that could have ended in a small firm's bankruptcy
It all started with a routine documentation check at one of the primary schools in Poznań that used an external system for learning mathematics. Officials from the board of education, instead of focusing on whether children are actually calculating better, scrutinized the technical aspects of logging into the platform. They found a gap in the way user sessions were stored, which they interpreted as a flagrant violation of student personal data protection. For the company from Poznań, which employed 14 people at the time and was just getting back on track after server investments, a penalty of 43,185 PLN was a death sentence for their financial liquidity in the fourth quarter.
Regulations are our field, so we immediately knew the office's interpretation was too rigid and did not take into account the specifics of modern cloud systems. At Sgela Education Advocacy, we don't engage in philosophizing about law; we look for gaps in bureaucratic thinking. We analyzed 17 similar cases from the last 11 months and noticed that in three other voivodeships, the same login method was considered completely safe. This was our starting point. An official in Poznań cannot punish for something that an official in Lublin or Rzeszów considers standard.
Piotr Wiśniewski, our legal analyst, spent 19 hours analyzing the client's system logs along with programmers from a Kraków software house that built the system. We had to have hard evidence that the data was better protected than in the ministry's own system before we even started writing any appeal. We knew we had only one chance to block this decision before it entered legal force and blocked the company's accounts.
An official doesn't have to know code, but must understand that technology moves faster than their 2019 instructions.
Why do officials read the same regulations in different ways?
The problem was that Article 14 of the March 2023 regulation is written in such vague language that every superintendent can understand it their own way. At Sgela Education Advocacy, we don't play at writing thick volumes of theory that interest no one. We lay it on the line: the system was safe, the official just didn't understand JWT token technology. Instead of sending more letters that would get stuck in binders for 3 months, we prepared a specific technical comparison in a table, where on one side was the regulation and on the other, proof from the database.
Our experience with 423 clients served since 2016 shows that offices are afraid of confronting someone who has harder data than they do. In this specific case from Poznań, the board of education based its decision on the opinion of one expert who had taken his last cybersecurity course in 2014. That was our advantage. We pointed out 7 logical errors in his assessment, which immediately put the entire proceeding into question. We didn't attack the man; we pointed out the lack of current technical knowledge, which is crucial in this industry.
In mid-October, the situation became tense as the penalty payment deadline approached relentlessly. We had to act on two fronts: a formal appeal to a higher instance and a direct inquiry to the department in Warsaw. We know who picks up the phone at the ministry and who actually makes decisions about binding interpretations. Without unnecessary talk about vision, we presented the matter as a systemic problem that could hit hundreds of other schools using similar solutions nationwide.
74 minutes in Warsaw that saved the platform's budget
Instead of waiting for an administrative court ruling, which takes an average of 514 days in Poland, we went straight to the capital. Our meeting in the education digitization department lasted exactly 74 minutes. We showed that the penalty for the Poznań platform would directly hit 3,420 students who would lose access to materials before mock exams overnight. The argument about the student's welfare combined with hard data about data encryption (AES-256) worked better than any pleas for mercy. Officials in the ministry agreed with us that the board of education in Poznań had taken too restrictive an approach to interpreting the new norm.
The effect was instantaneous. Four days later, an explanatory opinion arrived from above at the board of education in Poznań. It wasn't a suggestion, but a clear instruction on how Article 14 should be interpreted in the context of modern login methods. It was a win not only for our client but for the entire EdTech sector. At Sgela Education Advocacy, we believe that one won battle can change the rules of the war for everyone. Thanks to this, this intervention helped 47 other companies that had similar systems but had not yet been inspected.
After returning to our office in Lublin at 4 Grodzka Street, we prepared a new technical terms of service for the client that is 'official-proof'. We shortened the time needed for logging in by 1.4 seconds while increasing the security level so that no inspector would have anything to complain about. The client paid us a fraction of the penalty amount, and the saved 43,185 PLN was invested in developing a physics learning module. This is how we understand effective business support.
What lessons follow from this case for other schools and companies?
The most important conclusion is this: never accept a fine or penalty from the board of education without a fight if you know your technology works correctly. Officials often operate on old guidelines that do not fit today's code. Since the beginning of 2024, we have already had 47 won cases of this type. The average time needed to set aside an incorrect decision in our performance is 11 business days, as long as we enter the game at the protocol stage, not at the final decision stage.
It's also worth ensuring that technical documentation is written in language understandable to a layman, but with strong references to ISO standards. We at Sgela Education Advocacy help 'translate' programmer language into official language, which usually cuts 84.6% of questions during an inspection. Don't wait until they knock on your door from Poznań or Lublin. Check your systems now, because the average cost of adapting a platform is 9 times lower than the lowest penalty provided in the new schedule.
Today, this client from Poznań serves 217 schools and sleeps peacefully. Our cooperation did not end with this one case; now we audit their code changes legally every quarter. This is exactly what we call an effective voice in the ministry – not just fire extinguishing, but building protection that allows for growth without fear of the next letter from the office. If you have a similar problem, we invite you for coffee in Lublin, we'll lay it on the table and tell you honestly what your chances are.
Effective lobbying is not dinners with politicians, it's 19 hours of log analysis to prove an official's error in their own regulation.
