TRANSLATION
PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Jan Nowak
Warsaw, 10 November 2021
ZSPR.440.1779.2019.PT.WU
Previous Ref. No.: ZSPR.440.1662.2019.ZS.MKA
DECISION
On the basis of Article 105 § 1 of the Act of 14 June 1960 Code of Administrative
Procedure (consolidated text: Dz. U. [Journal of Laws] of 2021 item 735), and Article 7
paragraph 1 and 2 of the Act of 10 May 2018 on the personal data protection (consolidated text:
Dz. U. [Journal of Laws] of 2019 item 1781) and Article 60 (8) of the Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (OJ EU L 119 of 04/05/2016, p. 1, OJ EU L 127 of
23/05/2018, p. 2 and OJ EU L 74 of 04/03/2021, p. 35) after having carried administrative
proceedings in the case of , residing in
, relating to irregularities in the processing of his personal data by
based in Budapest, , by failing to comply with
the request to erase his personal data, the President of the Personal Data Protection Office
shall discontinue the proceedings.
Justification
The Personal Data Protection Office received a complaint from ,
residing in , hereinafter referred to as the Complainant,
on irregularities in the processing of his personal data by with
its registered office in Budapest , hereinafter referred to as
the Company, consisting in failure to comply with the request to erase his personal data.
1
In the course of the administrative proceedings, the President of the Personal Data
Protection Office, hereinafter also referred to as the President of the Office, established the
following facts.
1. The Complainant received unwanted marketing messages at his email addresses:
, , and
;
2. The Complainant used the "wypisz się/unsubscribe" button in order not to receive
further messages;
3. The Complainant also requested by an email to discontinue sending marketing messages
to his email addresses;
4. Regarding the cross-border nature of proceedings pursuant to Article 4(23) of the
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April
2016 on the protection of natural persons with regard to the processing of personal data
and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L 119
of 04/05/2016, p. 1, OJ EU L 127 of 23/05/2018, p. 2 and OJ EU L 74 of 04/03/2021,
p. 35), hereinafter referred to as: GDPR, pursuant to Article 56(1) GDPR the
proceedings has been referred to the lead supervisory authority, which is the Hungarian
supervisory authority (Nemzeti Adatvédelmi és Információszabadság Hatóság),
hereinafter referred to as the ‘Hungarian Supervisory Authority’;
5. The Hungarian Supervisory Authority considered itself to be the lead authority on 16
January 2020 based on the fact that the Company has its headquarters in Hungary;
6. The Hungarian Supervisory Authority asked the President of the Office to provide
documents certifying that there is a button or a link in the emails sent by the Controller
to unsubscribe from the newsletter;
7. On 9 June 2020, the President of the Office asked the Complainant to provide
documents confirming that in the emails sent by the Controller there is a button or a link
to unsubscribe from receiving the newsletter;
8. The Complainant attached to the letter of 9 June 2020 his e-mail correspondence with
the Company confirming that in the emails sent by the Company there is a link to
unsubscribe from receiving the newsletter;
9. The President of the Office forwarded to the Hungarian Supervisory Authority the
documents which received from the Complainant together with their translation into
English;
10. The Hungarian Supervisory Authority informed that it had contacted the Company,
which informed that it was not the owner of the domains from which marketing
messages are sent to the Complainant;
11. The Hungarian Supervisory Authority issued a draft decision in the case in which it
concluded that in relation to the finding that it is not the Company that is sending
marketing messages to the Complainant, it is not the lead authority within the meaning
of Article 56(1) GDPR and ended the proceedings;
12. The President of the Office did not raise a reasoned objection to the draft decision and
agreed with the draft decision prepared by the Hungarian Supervisory Authority;
13. In relation to the dismissal of the Complainant’s complaint by the Hungarian
Supervisory Authority, the President of the Office, pursuant to Article 60(8) GDPR, as
the authority receiving a complaint, is obliged to adopt a decision.
The President of the Office, after reviewing all the evidence gathered, considered the
following.
The Complainant indicated in the complaint that the company
with its registered office in Budapest, at , as a
defendant. The President of the Office, acting as a public authority, is bound by the content of
the complaint and the scope of the party’s request.
It should be pointed out that the President of the Office, when issuing an administrative
decision, is obliged to decide on the basis of the facts existing at the time of the adoption of that
decision. As stated in the legal doctrine, “the public authority shall assess the facts of the case
at the time when the administrative decision was adopted. This rule also applies to the
assessment of the legal status of the case, which means that the public authority issues an
administrative decision on the basis of the legal provisions in force at the time of its adoption
(...). Adjudication in administrative proceedings consists of applying the law to the established
facts of an administrative case. In this way the public authority pursues the purpose of
administrative proceedings, which is to implement a binding legal norm in administrative-legal
relations, when these relations require it” (Commentary to the statute of 14 June 1960, Code of
Administrative Procedure, M. Jaśkowska, A. Wróbel, Lex., el/2012). Furthermore, in the
judgment of 7 May 2008 in the case Ref. No. I OSK 761/07, the Polish Supreme Administrative
Court stated that “when examining the lawfulness of personal data processing, the GIODO is
obliged to determine whether, on the date of issuing a decision in the case, data of a particular
entity are processed and whether this is done in a lawful manner”.
The decisive factor for the decision to be issued in this case is the fact that the Company
does not process the Complainant’s personal data and is not the Controller of the domains from
which the Complainant receives unwanted marketing messages.
Under these circumstances, the present proceedings are subject to discontinuation
pursuant to Article 105 § 1 of the Act of 14 June 1960 Code of Administrative Procedure
(consolidated text: Dz. U. [Journal of Laws] of 2021 item 735), hereinafter referred to as Kpa,
due to the fact they have become devoid of purpose. Under that provision, where the
proceedings have for any reason become devoid of purpose in whole or in part, the public
authority is to issue a decision to discontinue the proceedings in whole or in part, respectively.
The wording of that provision leaves no doubt that, if the proceedings is found to be devoid of
purpose, the authority conducting the proceedings mandatorily discontinues them. At the same
time, the literature on the subject-matter indicates that the administrative procedure devoid of
purpose, as provided for in Article 105(1) of the Code of Administrative Procedure, means that
there is no element of a substantive legal relationship and, therefore, no decision can be taken
to settle the case by deciding on the merits of the case (B. Adamiak, J. Borkowski 'Code of
Administrative Procedure. Commentary" 7th edition, C.H. Beck, Warsaw 2005, p. 485). The
same position was taken by the Provincial Administrative Court in Cracow in its judgment of
27 February 2008 (III SA/Kr 762/2007): “Proceedings shall become devoid of purpose if one
of the elements of the substantive relationship is absent, which means that the case cannot be
settled by a decision on the merits”.
The assessment carried out by the President of the Office shall in each case examine the
validity of referring to a particular entity a decision corresponding to the content of Article
58(2) GDPR, which is intended to restore the lawful state of the processing of data - is therefore
justified and necessary only insofar as the processing of personal data in question exists.
In this factual and legal state, the President of the Personal Data Protection Office
adjudicated as in the operative part.
Under the authority of the President
of the Personal Data Protection Office
This decision is a final decision. Based on Article 7 para. 2 of the Act of 10 May 2018 on the Protection of Personal
Data (consolidated text: Dz. U. [Journal of Laws] of 2019, item 1781) and in connection with Article 13 § 2,
Article 53 § 1 and Article 54 of the Act of 30 August 2002 Law on proceedings before administrative courts
(consolidated text: Dz. U. [Journal of Laws] of 2019, item 2325), the party has the right to bring a complaint to
the Wojewódzki Sąd Administracyjny w Warszawie [Voivodeship Administrative Court in Warsaw] against this
decision, within 30 days from the date of delivery of this decision, through the President of the Personal Data
Protection Office (address: Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa). The fee for the
complaint is PLN 200. The party has the right to apply for the right of assistance, which includes exemption from
court costs and the appointment of an attorney, legal advisor, tax advisor or patent attorney. The right of assistance
may be granted upon application by a party submitted prior to the initiation of the proceedings or in the course of
the proceedings. This application is exempt from court fees.