TRANSLATION
PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Jan Nowak
Warsaw, 23 March, 2020
ZSPR.440.1959.2019.PT.MKA
(Previous case number ZSPR.440.1959.2019.ZS.MKA)
DECISION
Pursuant to Article 104 § 1 of the Act of 14 June 1960 Code of Administrative Procedure
(Journal of Laws 2020, item 256, as amended), Article 5(1)(b), Article 6(1), Article 17(1)(a),
Article 58(2)(c) and Article 60(7) of the Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation), (Journal of Laws EU L 119 of 04.05.2016, p. 1
and Journal of Laws of the EU L 127 of 23.05.2018, p. 2), having conducted an administrative
procedure in the case of complaint of , residing in
regarding the irregularities in the processing of his personal data by
with its seat in , consisting in not complying
with a request to erase the personal data of , the President of the Personal
Data Protection Office,
orders to erase the
personal data of
, in the scope of: name, surname, PESEL number, mother's family
name, parents' names, date of birth, gender, country of birth, place of birth, residence
status, tax status, citizenship, residence address, correspondence address, e-mail
address, series and number of identification document “dowód osobisty”, passport
number, mobile phone number, marital status, housing status, education, number of
people in the household, costs of the household, source of income, period of acquiring
income, employer's data, active profession, amount of income.
Personal Data Phone: +48 22 531-07-51
Protection Office
Stawki 2 street
00-193 Warsaw www.uodo.gov.pl
Substantiation
Complaint has been lodged with the President of the Personal Data Protection Office
[hereinafter: the President of the Office] by , residing in
[hereinafter: the Complainant] regarding the irregularities in the
processing of his personal data by
[hereinafter: the Bank], consisting in not complying with a request to erase the personal
data of the Complainant.
In the complaint the Complainant requested the erasure of all his personal data by the
Bank.
In the course of the procedure the President of the Personal Data Protection Office has
established the following factual state.
1. The Bank has indicated that it has obtained the personal data of the Complainant directly
from him, in connection with the conclusion of agreements of 23 September 2013,
including a framework agreement for the usage of an internet banking system as well as
an account agreement, agreement for a payment card to the account and the agreement
for the usage of an electronic banking system for individual clients. (evidence: letter of
the Bank of 13 March 2020 with attachments)
2. In connection with the conclusion and execution of the agreements the Bank has obtained
the data of the Complainant in the scope of: name, surname, PESEL number, mother's
family name, parents' names, date of birth, gender, country of birth, place of birth,
residence status, tax status, citizenship, residence address, correspondence address, e-
mail address, series and number of identification document “dowód osobisty”, passport
number, mobile phone number, marital status, housing status, education, number of
people in the household, costs of the household, source of income, period of acquiring
income, employer's data, active profession, amount of income. (evidence: letter of the
Bank of 13 March 2020 with attachments)
3. In October 2018 the Complainant has issued a disposition to close all the bank accounts
and to terminate all the agreements which he entered into with the Bank (evidence:
request of the Complainant of 4 August 2019)
4. On 26 and 27 July 2019, the Complainant received e-mail messages, which according to
him were of marketing nature and in connection with the messages received, the
2
Complainant requested the Bank to erase his data and discontinue the processing of data
for marketing purposes (evidence: the Complainant’s request of 4 August 2019)
5. The complainant has issued a request to erase his personal data and to discontinue the
processing of his data for marketing purposes on 12 September 2019 (evidence: the
Bank's letter of 13 March 2020 with attachments)
6. The e-mail correspondence sent to the Complainant on 26 July 2019 wasn’t of marketing
nature, but only constituted informational communication related to the change in the
method of providing the obligatory reports (daily transaction confirmations and quarterly
brokerage account statements). (evidence: the Bank's letter of 13 March 2020 with
attachments)
7. On 16 September 2019 the Bank has replied to the Complainant's requests, indicating that
it is discontinuing the processing of his personal data for marketing purposes. In addition,
he was informed about the closure of the service and was assured that the
data will be processed only for archival purposes. (evidence: the Bank’s letter of 13
March 2020 with attachments)
8. The Bank, after it has received the Complainant's complaint, analyzed the response sent
to the Complainant on 16 September 2019 and found that its reply was incomplete. The
Bank did not provide the Complainant with information on data processing in connection
with the “Agreement for the provision of services of accepting and transferring orders for
acquisition and re-acquisition of participation titles in collective investment institutions”
of 29 June 2016. The above irregularity was the result of an employee's error who has not
verified that the client possessed the abovementioned agreement and has not closed it. As
a consequence, the Complainant received incorrect information that his data was
processed only for archival purposes. In connection with the wrongful compliance with
the Complainant's request for the erasure of personal data, the Bank undertook corrective
measures: • sent a letter to the Complainant with rectification of information regarding
the processing of his personal data; • on 3 March 2020 it has closed the "“Agreement for
the provision of services of accepting and transferring orders for acquisition and re-
acquisition of participation titles in collective investment institutions” • took out
consequences against the employee who provided incorrect information regarding the
processing of the Complainant's data; • introduced a "checklist of the employee’s actions
while handling the client's request", which aims to minimize the likelihood of such errors
in the future; • scheduled a training for employees responsible for answering clients in the
scope of personal data.
3
9. Currently, the Bank processes the obtained Complainant's personal data for archival
purposes. The Complainant's personal data will be processed for a period of 10 years
from the date of termination of the "Agreement for the account “Open Savings Account
Bonus" of 31 December 2017, which was terminated on 30 April 2018 (this is the period
for agreements terminated before 9 July 2018). However, for agreements terminated after
9 July 2020 personal data will be processed for a period of 6 years from the date of
termination of the agreement. The legal basis for the processing of data for the indicated
periods is Article 118 of the Act of 23 April 1964 Civil Code (hereinafter: the Civil
Code). These periods differ due to the Act amending the Civil Code (Act of 13 April
2018 on amending the Civil Code and certain other acts) which entered into force on 9
July 2018 and modified the limitation period for claims (proof: Bank's letter of March 13,
2020 with attachments)
After getting acquainted with the collected evidence, the President of the Office has
considered the following.
The President of the Office, when issuing an administrative decision, is obliged to
adjudicate based on the factual state at the time of the decision. As indicated in the doctrine, “the
public administration body assesses the factual state of the case according to the moment of
issuing the administrative decision. This rule also applies to the assessment of the legal state of
the case, which means that the public administration authority issues an administrative decision
on the basis of the provisions of law in force at the time of its issuance (...). Adjudication in
administrative procedures consists in applying the law in force to the established factual state of
an administrative case. In this way, the public administration body realizes the purpose of
administrative procedures, which is the implementation of the binding legal norm in the field of
administrative-legal relations, when such relations require it” (Commentary to the Act of 14 June
1960 Code of Administrative Procedure (Journal of Laws 00.98.1071) M. Jaśkowska, A.
Wróbel, Lex., el/2012). Furthermore, in the judgment of 7 May 2008 in the case with reference
number I OSK 761/07 The Supreme Administrative Court stated that “when examining the
legality of the processing of personal data, GIODO is obliged to determine whether the data of a
specific entity are processed on the date of adjudicating the case and whether it is conducted in
accordance with the law”.
Firstly, it should indicated that Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation), (Journal of Laws EU L 119 of 04.05.2016, p. 1
4
and Journal of Laws of the EU L 127 of 23.05.2018, p. 2) [hereinafter: GDPR] determines the
lawfulness of processing of personal data. Each of the conditions in Article 6(1) of the GDPR is
autonomous and independent, which means that the fulfillment of one of them in a given case
confirms the lawfulness of the processing of personal data. Furthermore, it should also be
emphasized that the consent of the data subject is not the only basis legalizing the processing of
its personal data (point a). The data processing will be compliant with the provisions of the act
also when the data controller demonstrates that at least one condition of the aforementioned
Article 6(1) of the GPDR is met. This provision states that the processing is lawful, when, among
others: processing is necessary for the performance of a contract to which the data subject is
party or in order to take steps at the request of the data subject prior to entering into a contract
(Article 6(1)(b)); processing is necessary for compliance with a legal obligation to which the
controller is subject (Article 6(1)(b)); processing is necessary for the purposes of the legitimate
interests pursued by the controller or by a third party, except where such interests are overridden
by the interests or fundamental rights and freedoms of the data subject which require protection
of personal data, in particular where the data subject is a child (Article 6(1)(f)).
Pursuant to Article 5(1)(b) of the GDPR, personal data must be collected for specified,
explicit and legitimate purposes and not further processed in a manner that is incompatible with
those purposes. Until the Complainant has issued a disposition to terminate all agreements
between him and the Bank in October 2018, while processing the Complainant's personal data
the Bank had the legal basis for the processing in accordance with Article 6(1)(b) of the GDPR
After issuing the disposition to terminate all agreements between the Complainant and
the Bank and in connection with the request to erase all his personal data of 12 September 2019,
in the opinion of the President of the Office, the processing of the Complainant's personal data
by the Bank in the scope of name, surname, PESEL number, mother's family name, parents'
names, date of birth, gender, country of birth, place of birth, residence status, tax status,
citizenship, residence address, correspondence address, e-mail address, series and number of
identification document “dowód osobisty”, passport number, mobile phone number, marital
status, housing status, education, number of people in the household, costs of the household,
source of income, period of acquiring income, employer's data, active profession, amount of
income, has not been legally substantiated by the provisions of the GDPR. Further processing of
the Complainant's personal data by the Bank constitutes a breach of Article 6(1) and 17(1) of the
GDPR. According to Article 17(1)(a) of the GDPR, the data subject shall have the right to obtain
from the controller the erasure of personal data concerning him or her without undue delay and
the controller shall have the obligation to erase personal data without undue delay including if
5
the personal data are no longer necessary in relation to the purposes for which they were
collected or otherwise processed.
The Bank indicated that it is currently processing the Complainant's data for archiving
purposes, but has in no way demonstrated the circumstances justifying the processing after the
Complainant has closed all the agreements. Moreover, the Bank indicated that the legal basis for
data processing period is Article 118 of the Civil Code.
The period of storage of the Complainant's personal data was determined in relation to
the protection against potential claims of the Complainant, it must be stated that the evidence
collected in this case did not show that the Complainant has raised any claims against the Bank
which would justify the Bank's right to store and process his personal data for evidence purposes
in relation to the Complainant’s exercise of his claim. Therefore, In the opinion of the President
of the Office, the condition of necessity for the purposes of the legitimate interests pursued by
the controller with regard to the processing of the Complainant’s personal data has not been
fulfilled.
The condition of Article 6(1)(f) of the GDPR applies to an already existing situation in
which the purpose resulting from the legitimate interests pursued by the controller is the
necessity to prove, the necessity to exercise or to defend against an existing claim, and not a
situation in which data is processed in order to protect against a potential claim. Since the
administrative procedure conducted by the President of the Office has not shown that the
Complainant raised any claims against the Bank, it must be stated that the Bank processes the
Complainant’s personal data in the abovementioned purpose for the purpose only “in case of”, in
order to protect against potential and uncertain claims of the Complainant. The President of the
Office also agrees with the position of the Voivodeship Administrative Court in Warsaw
regarding the condition analogous to the condition of Article 6(1)(f) of the GDPR, namely the
condition resulting from Article 23(1)(5) of the Act of 29 August 1997 on the Protection of
Personal Data (Journal of Laws of 2016, item 922, as amended), regarding the legality of
processing personal data necessary for the legally justified purposes carried out by data
controllers or data recipients, when the processing does not violate the rights and freedom of the
data subject. The court in its the judgment of 1 December 2010 in the case with reference
number II SA/Wa 1212/10 (LEX no. 755113) ruled, quote: “In the present case, the authority
argued that the complainant had raised objections to the company regarding the legality of the
processing of his data and announced the intent to bring the case before the court. Hence, the
company was entitled to record the complainant's data and keep them for evidence purposes in
the event that the complainant exercised any claims. In the opinion of the Court, the above
6
circumstances do not meet the condition of legally justified purposes for processing of the
complainant's data. It should be noted that the condition of Art. 23(1)(5) of the act applies to an
already existing and certain situation, i.e. when there is a necessity to prove, the necessity to
exercise a claim related to business activity, and not a situation where data is processed in the
event of a potential procedure and a potential necessity to prove that the personal data obtained
without the consent of the data subject are processed in accordance with the law. Therefore, in
the opinion of the Court, the company cannot process the complainant's personal data only in
order to protect itself against a potential future and uncertain claim of the complainant.
Otherwise, there may be doubt regarding how long the complainant's personal data should be
processed if he fails to fulfill his announced intention”.
It should be emphasized that if the abovementioned provisions were interpreted
differently, the Complainant would be deprived of protection under the GDPR and the Act of 10
May 2018 on the Protection of Personal Data (Journal of Laws 2019, item 1781). It must be
stated that accepting the position that the processing of personal data in order to avoid negative
consequences in the event of raising a potential and undefined claim in the future is a legitimate
interest within the meaning of Article 6(1)(f) of the GDPR as correct, would mean that the
Complainant's personal data may be processed by the Bank permanently, without the necessity to
erase them. It is theoretically possible for the Complainant to raise a claim with the Bank after
the limitation period for the claim has expired. This would lead to the conclusion that the
processing of the Complainant's personal data by the Bank is justified by the condition of Article
6(1)(f) of the GDPR for the purpose of exercising the right to defense against a potential claim of
the Complainant also after the expiry of the abovementioned period.
At this point, it must be indicated that there is no justification in assuming that periods for
the limitation of claims arising from the obligations also define the periods in which personal
data may be processed by the Bank. It is necessary to indicate that the limitation period for a
claim does not have effects in the field of protection of personal data, as it does not affect the
existence of the claim, but only affects the field of procedural charges in the form of the
possibility of raising the limitation of claims in a court dispute. It should be emphasized that the
circumstance justifying the processing of personal data for the purpose of exercising claims is
the very fact of the existence of a claim and the intention to exercise it, but not a change in the
procedural rights of the defendant entity.
It must be stated that a public administration body may consider the factual state of the
case as established only on the basis of undoubtable evidence and in this respect, it cannot limit
itself to making what is probable - unless the provisions of the Act of 14 June 1960 Code of
7
Administrative Procedure (Journal of Laws 2020, item 256, as amended) (hereinafter: Code of
Administrative Procedure) provide otherwise (e.g. Article 24 of the Code of Administrative
Procedure). As indicated by the Supreme Administrative Court in the judgment of 9 July 1999
(III SA 5417/98), "the authority conducting the procedure must seek to establish the material
truth and, according to its knowledge, experience and internal reasoning, assess the evidential
value of individual evidence, the impact of proving one circumstance on other circumstances”. In
the same judgment, the Court also stated that there is a rule in an administrative procedure that
the burden of evidence lies with the person who derives legal consequences from a specific fact.
Therefore, there are grounds to apply the provision of Article 58(2)(c) of the GDPR.
Pursuant to this provision, in the event of a breach of the provisions on the protection of personal
data, the President of the Office orders the controller or the processor to comply with the data
subject's requests to exercise his or her rights pursuant to the GDPR. Therefore, the obligatory
condition has been met for the President to the Office to issue a decision ordering the erasure of
the Complainant’s personal data in the scope of his name, surname, PESEL number, mother's
family name, parents' names, date of birth, gender, country of birth, place of birth, residence
status, tax status, citizenship, residence address, correspondence address, e-mail address, series
and number of identification document “dowód osobisty”, passport number, mobile phone
number, marital status, housing status, education, number of people in the household, costs of the
household, source of income, period of acquiring income, employer's data, active profession,
amount of income.
In this factual and legal state, the President of the Personal Data Protection Office has
adjudicated as indicated in the operative part of the decision.
Under the authority of the President
of the Personal Data Protection Office
The decision is final. Pursuant to Article 7(2) of the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws
2019, item 1781) in connection with Article 13 § 2, Article 53 § 1 and Article 54 § 1 of the Act of 30 August 30 2002 Law on
Procedure before Administrative Courts (Journal of Laws 2018, item 1302, as amended), the party has the right to lodge a
complaint against this decision with the Voivodeship Administrative Court in Warsaw, within 30 days from the date of its
delivery to the party. The complaint is lodged via the President of the Personal Data Protection Office. The fee for the complaint
8
is in the amount of 200 PLN. The party has the right to apply for the right of aid, which includes exemption from court costs and
the appointment of an attorney, legal advisor, tax advisor or patent attorney. The right of aid may be granted upon the request of a
party submitted before the initiation of the procedure or in the course of the procedure. This request is free of court fees.
9