TRANSLATION
PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Jan Nowak
Warsaw, 29 July 2022
DS.523.2402.2020.ZS.JKO.
DECISION
Pursuant to Article 104 § 1 and Article 105 § 1 of the Act of 14 June 1960 Code of
Administrative Procedure (Journal of Laws 2021, item 735, as amended) in connection with
Article 7(1) of the Act on Personal Data Protection of 10 May 2018 (Journal of Laws of 2019,
item 1781), Article 5(1)(a), Article 5(2), Article 12 (1), Article 13(1)(a), (c) and (e), Article
13(2)(a)(b)(d) and (e) and Article 58(2)(c) of the Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard
to the processing of personal data and on the free movement of such data, and repealing
Directive 95/46/EC (General Data Protection Regulation), (Journal of Laws EU L 119 of
04.05.2016, p. 1 and Journal of Laws of the EU L 127 of 23.05.2018, p. 2 and Journal of Laws
UE L 74 of 4.03.2021, p. 35) (hereinafter: GDPR), having conducted an administrative
proceedings concerning the complaint lodged by (address:
, Lithuania), regarding the irregularities in the
processing of his personal data by and , who
conduct business activity under the name ,
(address: Poland), (hereinafter:
collectively referred to as Entrepreneurs), consisting in sharing personal data with third parties,
failing to comply with the obligation to provide information and failing to provide access to data,
the President of the Personal Data Protection Office
1. orders and , pursuing business activity as part
of the civil partnership under the name
(address:
Poland), to comply with the obligation of , residing at
Lithuania, the information obligation
pursuant to Article 13 (1) (a), (c), (e) and para. (2) (a), (b), (d),(e) of the Regulation (EU)
Personal Data Phone +48 22 531-07-51
Protection Office
Stawki 2 street
00-193 Warsaw www.uodo.gov.pl
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection
of natural persons with regard to the processing of personal data and on the free movement
of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
(Journal of Laws EU L 119 of 04.05.2016, p. 1 and Journal of Laws of the EU L 127 of
23.05.2018, p. 2 and Journal of Laws UE L 74 of 4.03.2021, p. 35), by sending the required
information to the Complainant's correspondence address or email address,
2. in the remaining scope it discontinues the proceedings.
Justification
The Personal Data Protection Office has received from the Lithuanian Supervisory
Authority (hereinafter: Lithuanian SA), through the Internal Market Information System between
supervisory authorities (IMI system), a complaint case regarding irregularities in the processing
of personal data of (residing at
, Lithuania), hereinafter referred to as: "the Complainant", by
and , conducting business under the name
, (address: ,
Poland), hereinafter collectively referred to as the "Entrepreneurs", in connection with the
sharing of the Complainant's personal data with third parties, failure to comply with the
information obligation and failure to grant the Complainant access to the data. The Polish
Supervisory Authority, namely the President of the Personal Data Protection Office (hereinafter:
"President of the PDPO"), having analysed the facts of the case, considered itself in the present
case to be the lead supervisory authority (LSA) pursuant to Article 56(1) of Regulation (EU)
2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation), (Journal of Laws
EU L 119 of 04.05.2016, p. 1 and Journal of Laws of the EU L 127 of 23.05.2018, p. 2 and
Journal of Laws UE L 74 of 4.03.2021, p. 35) - hereinafter referred to as: "GDPR", due to the
registered office of the Entrepreneurs, which was located on the territory of Poland, as informed
by the Lithuanian SA during the proceedings.
In the content of the complaint dated on 18 November 2019, transmitted in the IMI
system by the Lithuanian SA on 26 February 2020, the Complainant indicated that the
Entrepreneurs violated its rights, did not comply with the sales regulations, European guarantee
obligations and rules on personal data protection. Complainant also indicated,
2
that the Entrepreneurs shared his personal data with third parties. The Complainant further
pointed out that the rules for processing personal data were not available on the Entrepreneurs'
website, he was not provided with information about the data processing, and he was not granted
the right of access to the data.
In the course of the proceedings conducted in the present case, the President of the PDPO as
the LSA, established the following factual state.
1. On 10 June 2020, the President of the PDPO, through the Lithuanian SA, informed the
Complainant that this complaint case has been identified as cross-border nature pursuant
to Article 4(23) of the GDPR and has been forwarded to the Polish SA for conduct;
2. On 10 June 2020, the President of the PDPO requested the Entrepreneurs to respond to
the content of the complaint and to provide explanations in the case;
3. In explanations received by the Personal Data Protection Office on 26 June 2020, the
Entrepreneurs indicated the following:
a. On 10 July 2019, Entrepreneurs concluded a contract with Complainant for the sale
of the "Dorado" kayak [online store: /];
b. the Complainant's personal data are processed on the basis of Article 6(1)(b) GDPR,
which means that the processing was necessary for the performance of a contract to
which the Complainant was a party;
c. Entrepreneurs indicated that the scope of data processed includes the name and
surname, address, telephone number and e-mail address;
d. the Complainant's personal data were not shared with third parties; the Entrepreneurs
pointed out that the content of the complaint does not indicate when, and most
importantly to which entities, the data were to be shared;
e. The information obligation is fulfilled for customers of the online store who decide to
make a purchase via the website Customers must accept the
store's regulations (Terms and Conditions of Service), which specify in detail for
what purpose customer data are processed and what rights are granted in this
connection. The Regulations are available on the Entrepreneurs' website, and the
Complainant decided to purchase a kayak by sending an inquiry in the form
of an e-mail to the address also appearing on the aforementioned
website;
3
f. The Complainant never approached the Entrepreneurs with a request for access to the
processed data. The Complainant has not submitted any evidence to prove this,
despite making an allegation of this content against the Entrepreneurs.
4. On 17 July 2020, the Polish SA i.e. the President of the PDPO, provided the Complainant
with as part of informal consultations through the Lithuanian SA, the Entrepreneurs'
explanations translated in English;
5. On 20 July 2020, the Polish SA i.e. the President of the PDPO, submitted to the
Complainant, through the Lithuanian SA, a request for explanations in order to
supplement the evidence collected in the case. The scope of explanations included the
following questions:
a. when and to which entity Entrepreneurs shared the Complainant's personal data
b. when, in what form and to what extent the Complainant approached the
Entrepreneurs with a request for access to data. Please provide the content of the
request and confirmation that it was addressed to the Entrepreneurs.
6. The Complainant did not respond to a request for an explanations dated 20 July 2020;
7. On 24 July 2020, the Polish SA i.e. the President of the PDPO informed the
Entrepreneurs about the above and at the same time asked for supplementation of the
explanations submitted in the case;
8. On 17 August 2020, the President of the PDPO received the Entrepreneurs' response to
the above dated 11 August 2020, in which it was indicated that the Entrepreneurs
implement the information obligations to the extent and in the manner indicated in the
previous letter [i.e. dated June 2020]. Additionally, it was indicated that the
Entrepreneurs have used the services of an entity offering professional and complex
services in the area of implementation and proper performance of all obligations under
GDPR, which means that in the near future, any irregularities, if identified, will be
removed by the Entrepreneurs;
9. On 13 October 2020, the Polish SA i.e. the President of the PDPO, provided the
Complainant through the Lithuanian SA, additional explanations of the Entrepreneurs
translated to English;
10. On 13 October 2020 the Polish SA sent to the Lithuanian SA an e-mail with a request for
information whether the Complainant received a request for explanations in order to
supplement the evidence gathered in the case, which was forwarded through the IMI
system by the Polish SA on 20 July 2020 (reply of the Lithuanian SA about forwarding
the letter on 30 July 2020) and whether the Complainant responded to the letter;
4
11. On 20 October 2020, the Lithuanian SA responded via email indicating, that the
Complainant had received the letter, but had not responded. Additionally, on 15 October
2020, the Lithuanian SA contacted the Complainant and determined,
that the Complainant did not intend to respond to the received letter.
On these facts, the President of the PDPO has considered the following.
Indicate that, the President of the PDPO, when issuing an administrative decision, is
obliged to adjudicate based on the factual state at the time of the decision. As indicated in the
doctrine, “the public administration body assesses the factual state of the case according to the
moment of issuing the administrative decision. This rule also applies to the assessment of the
legal state of the case, which means that the public administration authority issues an
administrative decision on the basis of the provisions of law in force at the time of its issuance
(...). Adjudication in administrative procedures consists in applying the law in force to the
established factual state of an administrative case. In this way, the public administration body
realizes the purpose of administrative procedures, which is the implementation of the binding
legal norm in the field of administrative-legal relations, when such relations require it”
(Commentary to the Act of 14 June 1960 Code of Administrative Procedure M. Jaśkowska, A.
Wróbel, Lex., el/2012). Furthermore, in the judgment of 7 May 2008 in the case with reference
number I OSK 761/07 The Supreme Administrative Court stated that “when examining the
legality of the processing of personal data, GIODO1 is obliged to determine whether the data of a
specific entity are processed on the date of adjudicating the case and whether it is conducted in
accordance with the law”.
Pursuant to Article 5(1)(a) of the GDPR, personal data shall be processed lawfully, fairly
and in a transparent manner in relation to the data subject ("lawfulness, fairness and
transparency"). The principle of transparency is further detailed in Article 12(1) of the GDPR,
according to which the controller shall take appropriate measures to provide any information
referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating
to processing to the data subject in a concise, transparent, intelligible and easily accessible form,
using clear and plain language, in particular for any information addressed specifically to a child.
The information shall be provided in writing, or by other means, including, where appropriate,
by electronic means. When requested by the data subject, the information may be provided
orally, provided that the identity of the data subject is proven by other means.
Transparency is an overriding obligation under the GDPR that applies, among other
things, to the provision of information to data subjects. “The principle of transparency requires
1
currently the President of the Personal Data Protection Office.
5
that any information and communication relating to the processing of those personal data be
easily accessible and easy to understand, and that clear and plain language be used. That
principle concerns, in particular, information to the data subjects on the identity of
the controller and the purposes of the processing and further information to ensure fair and
transparent processing in respect of the natural persons concerned and their right to obtain
confirmation and communication of personal data concerning them which are being processed”
(Recital 39 GDPR). Therefore, it is important that the information addressed to the data subject
is concise, clear, understandable and easily accessible, and in clear and plain language.
With regard to the Complainant's request for an order requiring the Entrepreneurs to
comply with the obligation to provide information pursuant to Article 13(1) and (2) of the
GDPR, it must be pointed out that this obligation should be complied by the controller at the
time of obtaining the data, if the personal data were obtained from the data subject.
The controller shall then be obliged to provide the following information: his identity and
contact details and, where applicable, those of his representative (Article 13(1)(a)), where
applicable - the contact details of the Data Protection Officer (Article 13(1)(b)), the purposes of
the processing of personal data, and the legal basis for the processing (Article 13(1)(c)), where
the processing is based on Article 6(1)(f) - the lawful interests pursued by the controller
or by a third party (Article 13(1)(d)), information on the recipients of the personal data or
categories of recipients, if any (Article 13(1)(e)), where applicable - information on the intention
to transfer personal data to a third country or an international organisation and on whether or not
the Commission has made a finding of adequate protection or, in the case of transfers referred to
in Article 46, Article 47 or the second subparagraph of Article 49(1), information on adequate or
appropriate safeguards, and the possibility of obtaining a copy of the data or of making the data
available (Article 13(1)(f)).
Additionally, in accordance with Article 13(2) of the GDPR., in addition to the
information referred to in paragraph 1, the controller shall, at the time when personal data are
obtained, provide the data subject with the following further information necessary to ensure fair
and transparent processing: the period for which the personal data will be stored, or if that is not
possible, the criteria used to determine that period (Article 13 (2)(a)); the existence of the right to
request from the controller access to and rectification or erasure of personal data or restriction of
processing concerning the data subject or to object to processing as well as the right to data
portability (Article 13(2)(b)); where the processing is based on point (a) of Article 6(1) or point
(a) of Article 9(2), the existence of the right to withdraw consent at any time, without affecting
the lawfulness of processing based on consent before its withdrawal (Article 13(2)(c)); the right
6
to lodge a complaint with a supervisory authority (Article 13(2)(d); whether the provision of
personal data is a statutory or contractual requirement, or a requirement necessary to enter into a
contract, as well as whether the data subject is obliged to provide the personal data and of the
possible consequences of failure to provide such data (Article 13(2)(e)); the existence of
automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least
in those cases, meaningful information about the logic involved, as well as the significance and
the envisaged consequences of such processing for the data subject (Article 13(2)(f)).
As established in the course of the investigation, the Entrepreneurs were obliged
˗ at the time of obtaining the Complainant's personal data ˗ to provide the Complainant
information specified in Article 13 in terms of paragraphs (1)(a),(c),(e) and (2)(a),(b),(d),(e)
of the GDPR. In the present case, Article 13 (1)(b)(d)(f) and (2)(c) and (f) are not applicable.
The Entrepreneurs conduct their business through the website offering to
purchase kayaking equipment online, based on an already existing kayak store that manufactures
kayaks, belaying vests and life jackets i.e Entrepreneurs also offer
specialized kayak clothing and various accessories. The Entrepreneurs' Privacy and Data
Processing Policy, hereinafter referred to as the "Privacy Policy", is available under the "Terms
and Conditions" in §6 "Personal Data Security Policy" on the Entrepreneurs' website i.e.
. The Privacy Policy, which is available on the Entrepreneurs' website, is
therefore not presented in an easily accessible and transparent form for the Complainant.
The Privacy Policy, in order to satisfy the requirements of transparency and easily accessible
form, should be located in a separate section and contain all necessary information concerning
the processing of personal data by Entrepreneurs. In particular, it should be emphasized that the
Entrepreneurs offer the purchase of equipment to customers outside the territory of Poland, such
as the Complainant, and on the indicated website the Regulations of the online store are available
only in Polish, so taking appropriate measures also refers to the understandable form of the
Privacy Policy, which should be adapted in this case to international customers.
In the course of the proceedings it was also established that the Entrepreneurs concluded the
agreement for purchase of a kayak with the Complainant in a non-standard way, i.e. via e-mail.
The Entrepreneurs did not substantiate that they fulfilled the information obligation at the
moment of obtaining the Complainant's personal data, therefore the President of the PDPO, on
the basis of the evidence gathered and all circumstances of the case, decided that the information
obligation towards the Complainant was not fulfilled. The information obligation on
Entrepreneurs is fulfilled only if it is provided in a simple, understandable and easily accessible
7
form. Placing the information obligation as part of the Regulations does not comply with the
principle of transparency.
It is important to note that, the Privacy Policy is a document containing information that
determines the correct fulfilment by Entrepreneurs of the obligation arising from Article 13
of the GDPR. The Privacy Policy should therefore contain information related to the processing
of data of the data subject, otherwise the document does not comply with the condition of
transparency and it is necessary to extract information and match it with the data processing, in
which the data subject is involved.
Therefore, it is difficult to agree with the position of the Entrepreneurs that „the Company
fulfils its information obligations towards the store's customers who, when deciding to purchase
the Company's products via must accept the store's regulations (Terms of
Service), in which it is specified in detail for what purpose the customers' data are processed and
what rights they have in this connection. These regulations are published on the Company's
website, and the Complainant decided to purchase a kayak by sending an e-mail to
”. The Regulations, as stated above, are not a Privacy Policy.
The regulations should contain information on e.g. terms of sale, methods of payment and
delivery of goods or the possibility of withdrawal from the contract by the consumer.
As the Article 29 Working Party pointed out in its "Guidelines on Transparency under
Regulation 2016/6792, privacy notices should be individually designed - a generic notice of the
privacy policy of the owning or distributing company (…) is insufficient.
It was the Entrepreneurs' obligation to provide information to the Complainant who made a non-
standard purchase via email. The information placed in the Terms and Conditions (Regulations)
on the Entrepreneurs' website does not satisfy the information obligation under Article 13(1) and
(2) of the GDPR in this case. The Privacy Policy shall contain all information pursuant to Article
13 of the GDPR and comply with the requirements of Article 12(1) of the GDPR, in a clear and
precise language form, understandable to all users, including the Complainant.
For the above reasons, it should be stated that not only the content, but also the form and
the way in which the information should be provided to the data subject are important.
Therefore, the solution applied by the Entrepreneurs in the form of placing the Privacy Policy in
the Terms and Conditions does not comply with the requirements set out in Article 5(1)(a) and
12(1) of the GDPR.
2
Website: http://ec.europa.eu/newsroom/article29/news.cfm?item_type=1358&tpa_id=6936 .
8
In connection with the above, it should be pointed out that the Entrepreneurs violated
Article 13(1)(a),(c),(e) and (2)(a),(b),(d),(e) of the GDPR, as they did not provide the
Complainant with the indicated information when obtaining his personal data.
Pursuant to Article 58(2)(c) of the GDPR, each supervisory authority shall have of the
following investigative powers, the power to order the controller or processor to comply the data
subject's requests to exercise his or her rights pursuant to this Regulation. In view of the above,
the President of the PDPO considers it reasonable to order the Entrepreneurs to comply with the
information obligation towards the Complainant with regard to the identified violation of the
provisions of Article 13(1)(a)(c)(e) and (2)(a)(b)(d)(e) of Regulation (EU) 2016/679 in the form
of the information obligation.
At the same time it should be stated that, the remaining irregularities in the processing of
the Complainant's personal data raised in the complaint are unfounded.
The public administration authority may consider the facts of the resolved case as established
only on the basis of undisputed evidence and may not rest on probability in this regard - unless
the provisions of the Act of 14 June 1960 Code of Administrative Procedure (Journal of Laws
2021, item 735, as amended), hereinafter referred to as "kpa", provide differently.
As stated by the Supreme Administrative Court in the judgment of 9 July 1999 (III SA 5417/98)
"the authority conducting proceedings must strive to establish the material truth and according to
its knowledge, experience and internal conviction assess the probative value of particular means
of evidence, the impact of proof of one circumstance on other circumstances". In the same
judgment the Court also stated that in administrative proceedings the principle applies that the
burden of proof rests with the party who derives legal consequences from a given fact.
The Complainant correctly received a request for explanation from the Polish SA
on 20 July 2020 through the Lithuanian SA, but did not provide any response to it.
The scope of the Complainant's explanations was necessary to supplement the evidence and
included establishing when and for which entity the Entrepreneurs provided access to the
Complainant's personal data, and when, in what form and to what extent the Complainant
addressed the Entrepreneurs with a request for access to the data. The Complainant was also
informed in the summons, that failure to respond to the explanations may result in failure to
prove the claims and allegations presented by the Complainant and, consequently, in the
examination of the facts of the case and making a decision on the basis of the evidence gathered
so far. Additionally, on 15 October 2020, the Lithuanian SA contacted the Complainant and
established that it did not intend to respond to the letter received. It follows from the above that
the Complainant did not want to participate in the proceedings or submit relevant explanations
9
and evidence in the case. Therefore, in the opinion of the President of the PDPO in the absence
of sufficient evidence to prove the irregularities raised in the complaint, the President of the
PDPO is not in a position to continue the proceedings and decide on the merits of the case.
In this situation, these proceedings are discontinued pursuant to Article 105 § 1 of the Act
of 14 June 1960, Code of Administrative Procedure (hereinafter: "k.p.a."), because it is devoid of
purpose. Pursuant to the aforementioned provision, if the proceedings have become, for whatever
reason, wholly or partially pointless, the public administration authority shall issue a decision
to discontinue the proceedings in whole or in part, respectively. The meaning of the above
regulation leaves no doubt that in the event of determining that the proceedings have no purpose,
the authority conducting these proceedings shall obligatorily discontinue them. At the same time,
the literature on the subject indicates that the aimlessness of administrative proceedings, as
provided for in Article 105 § 1 of the Code of Administrative Procedure means that any of the
elements of a substantive legal relationship is absent, and therefore it is not possible to issue a
decision that settles the matter by deciding it on the merits (B. Adamiak, J. Borkowski "Code of
Administrative Procedure. Commentary" 7th edition, publishing house C.H. Beck, Warsaw
2005, p. 485). The same position was taken by the Provincial Administrative Court in Krakow in
the judgment of 27 February 2008. (III SA/Kr 762/2007): "A proceeding becomes pointless
when any of the elements of the substantive legal relationship is absent, which means that the
case cannot be settled by a decision on the merits."
Establishment by the public authority of the existence of the prerequisite referred to in
Article 105 § 1 of the Code of Administrative Procedure obliges it to discontinue the
proceedings, because then there are no grounds for resolving the case as to its merits, and
continuation of the proceedings in such a case would constitute its defect having a significant
impact on the outcome of the case.
In this factual and legal state, the President of the PDPO has adjudicated as indicated in
the operative part of the decision.
Under the authority of the President
of the Personal Data Protection Office
Director of the Complaints Department
10
The decision is final. Pursuant to Article 7(2) of the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws
2019, item 1781) in connection with Article 13 § 2, Article 53 § 1 and Article 54 § 1 of the Act of 30 August 30 2002 Law on
Procedure before Administrative Courts (Journal of Laws 2022, item 329, as amended), the party has the right to lodge a
complaint against this decision with the Voivodeship Administrative Court in Warsaw, within 30 days from the date of its
delivery to the party. The complaint is lodged via the President of the Personal Data Protection Office. The fee for the complaint
is in the amount of 200 PLN. The party has the right to apply for the right of aid, which includes exemption from court costs and
the appointment of an attorney, legal advisor, tax advisor or patent attorney. The right of aid may be granted upon the request of a
party submitted before the initiation of the procedure or in the course of the procedure. This request is free of court fees.
11