THE PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Jan Nowak
Warsaw, 24.11.2022
DS.523.1676.2021.ZS.WU
DECISION
Pursuant to Article 105(1) of the Act of 14 June 1960 Code of Administrative Procedure
(consolidated text: Journal of Laws Of Laws 2022, item 2000), Article 7(1) and 7(2) of the Act of 10
May 2018 on the personal data protection (Journal Of Laws 2019, item 1781) and Article 60(8) of
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the
protection of natural persons with regard to the processing of personal data and on the free movement
of such data, and repealing Directive 95/46/EC (OJ Office EU L 119, 04.05.2016, p. 1, OJ Office EU
L 127, 23.5.2018, p. 2 and OJ Office EU L 74, 04.03.2021, p. 35), following the administrative
procedure concerning Ms residing in Poland,
concerning irregularities in the processing of her personal data by ,
, with its registered office Luxembourg, consisting of the processing of an e-mail
address after the closure of the , the President of the Personal Data Protection Office
decides to discontinue the proceedings.
Justification
The Personal Data Protection Office (hereinafter: UODO) received a complaint from
residing in Poland, , on irregularities in the
processing of her personal data by with its registered office
Luxembourg (hereinafter: the Company), processing the email address after the closure of the
account.
In the course of the administrative procedure, the President of the UODO established the
following facts:
1. The Complainant stated that she had closed her user account. Following the closure of the
account, she received emails concerning the changes of the Terms and Conditions. The
Complainant did not request the Company to erase her email address, since, in her view,
1
contacting was possible only after logging in to the user account (evidence: Complainant’s
letter of 05.03.2021).
2. Since . is established in Luxembourg, the President of the
UODO, pursuant to Article 4(23) of Regulation (EU) 2016/679 of the European Parliament and
of the Council of 27 April 2016 on the protection of natural persons with regard to the processing
of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ
Office EU L 119, 04.05.2016, p. 1, OJ Office EU L 127, 23.5.2018, p. 2 and OJ Office EU L 74,
04.03.2021, p. (35) (hereinafter: GDPR), identified the cross-border nature of the case and on
08.07.2021, acting on the basis of Article 56(1) GDPR, forwarded a complaint to the Internal
Market Information System of the European Commission (hereinafter: IMI) to identify the lead
authority of the case and the authorities concerned (evidence: IMI Report A56ID 309483.1).
3. On 17.08.2021, the Luxembourg Supervisory Authority – Commission nationale pour la
protection des données (hereinafter: CNPD) recognised itself as the lead supervisory authority in
the case (evidence: IMI: LSA-CSA Feedback Report A56ID 309483.1).
4. On 17.08.2021, the CNPD, pursuant to Art. 61 GDPR, created IMI 61VMN notification
317716.1, in which it asked the UODO to provide it with additional information on the case. The
CNPD asked for the Complainant’s email address, linked to the deleted account. CNPD
also asked for all copies of correspondence between the Complainant and the Company and copies
of emails received after the closure of the user’s account. The CNPD indicated that the
Complainant had stated in the complaint that she had attempted to intervene directly in the
Company, but any contact with the service was possible only after logging into the user account.
CNPD pointed out that this information was not true as it was possible to contact the Company
by using the online form available after selecting the button ‘I cannot log in or I have no account’
(evidence: IMI REPORT 61VMN 317716.1).
5. The President of the UODO sent the letter to the Complainant with questions and findings of the
CNPD on 27.08.2021. The letter was effectively delivered on 06.09.2021 (evidence: letter from
the President of UODO of 27.08.2021 with a the acknowledgement of receipt). The Complainant
did not reply to that letter, which was communicated to the CNPD (evidence: IMI REPORT
61VMN 352334.1).
6. On 16.09.2022, the CNPD published a draft decision in the IMI system, dismissing the complaint
and indicating that, by derogation of Art. 60(7) GDPR, where a complaint is dismissed or rejected,
the supervisory authority with which the complaint was lodged shall adopt the decision and notify
it to the complainant and shall inform the controller thereof (evidence: A60DD IMI REPORT
2
438847.1). The President of the UODO agreed with the draft decision in the case (evidence:
A60DD Reasoned Objections Report 438847.1).
After examining all the evidence gathered in the case, the President of the UODO considered
the following.
Article 60 of the GDPR regulates the cooperation between the lead supervisory authority and
the other supervisory authorities concerned. In accordance with Article 60(1) GDPR, the lead
supervisory authority cooperate with the other supervisory authorities concerned. The lead
supervisory authority and the supervisory authorities concerned exchange all relevant information
with each other. According to Article 60(7) GDPR, the lead supervisory authority shall adopt and
notify the decision to the main establishment or single establishment of the controller or processor,
as the case may be and inform the other supervisory authorities concerned and the Board of the
decision in question, including a summary of the relevant facts and grounds. The supervisory
authority with which a complaint has been lodged shall inform the complainant on the decision. Art.
60(8) GDPR provides that, by derogation from paragraph 7, where a complaint is dismissed or
rejected, the supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof.
In the light of the above, the CNPD, acting as the lead supervisory authority in the case,
adopted a draft decision in which it discontinued the proceedings and acting on the basis of Article
60(8) GDPR, sent it to the President of the UODO, as the authority with which the complaint was
lodged. Consequently, the President of the UODO adopts a decision in this case.
The President of the UODO, acting on the basis of the Code of Administrative Procedure
(Journal of Laws Of Laws 2022, item 2000), hereafter: the KPA assesses, on the basis of all the
evidence gathered, whether a given circumstance has been proved. Evidence in proceedings may
include, in particular, documents, witness statements, expert opinions and visual inspection (Article
75(1) of the KPA). A public administration body may consider the facts of the case to be determined
only on the basis of clear evidence and cannot confine itself to establishing a prima facie case unless
otherwise provided for in the KPA.
In the present case, the Complainant indicated that she had a account, which she
decided to close, but despite the closure of the account, she received emails concerning changes of
the terms of the service. The Complainant also stated that she had attempted to intervene directly with
the Company, but in her view, contact with the service was possible only after logging in to the
account.
3
The CNPD, acting in its capacity as the lead supervisory authority in the case, asked the
Complainant to provide an e-mail address linked to the closed account, to forward a copy of all
correspondence between the Complainant and the Company and a copy of the emails received after
the closure of the account. The CNPD found that the Complainant’s claims that it was not
possible to contact the Company if she did not have a user account were not correct, since it was
possible to contact the Company using the online form available after selecting the button ‘I cannot
log in or I have no account’.
The President of the UODO sent a request for additional information and findings from the
CNPD to the Complainant on 27.08.2021, the letter was effectively delivered to the Complainant on
06.09.2021. The Complainant did not reply to it.
The Polish Supreme Administrative Court in its judgment of 26.10.1984 (ref.: II SA 1205/84,
ONSA 1984, No 2, item (98) ruled that: ‘It follows from Articles 7 and 77(1) of the Code of
Administrative Procedure that the authority conducting the administrative proceedings is required to
examine and consider all the evidence gathered exhaustively. This does not mean that a party is
exempted from complicity in the implementation of that obligation, especially since failure to prove
a particular fact may lead to adverse results for the party.’ The Supreme Administrative Court
reiterated this position in its judgment of 12.07.2017, ref. II GSK 2757/15, adding that (quote): ‘Nor
can it be inferred from those provisions that the administrative authorities are required to seek
evidence in support of a party’s assertions where that party does not itself take the initiative of
providing any evidence. In the event of a party’s inaction, the authority cannot be expected to prove
facts intended to militate against its findings.’
In the present case, the Complainant did not indicate to which e-mail address she received the
new messages, nor did she provide any evidence of receipt of such messages or any correspondence
with At the same time, the lead supervisory authority found that the Complainant’s claims
that it was not possible to contact the Company in the absence of a user account were not correct,
since it is possible to contact the Company using the online form available after selecting the button
‘I cannot log in or I have no account’.
In the light of the above, it must be concluded that the investigation carried out did not provide
evidence that the Complainant’s personal data had been processed in the form of her e-mail address
following the deletion of the user’s account in . In addition, no clear evidence was obtained
during the proceedings that the Complainant was unable to contact the Company in the absence of
a user account.
4
In accordance with Article 105(1) of the KPA, where proceedings have become devoid of
purpose for any reason, the administrative authority shall issue a decision to discontinue the
proceedings. The determination by a public authority of the existence of the condition referred to in
Article 105(1) of the KPA obliges it, as it is pointed out in doctrine and jurisprudence, to discontinue
proceedings, since there are no grounds for issuing a decision on the substance of the case where that
condition exists, and the continuation of the proceedings in such a case would amount to a flaw in
that case, which would have a significant impact on the outcome of the case.
According to the evidence gathered in the case, there is no proof to support the Complainant’s
allegations, so that it cannot be considered that the processing of the personal data had taken place,
with the result that those proceedings had become devoid of purpose.
In this factual and legal situation, the President of the Personal Data Protection Office decided
as set out in the operative part of this decision.
Under the authority of the President
of the Personal Data Protection Office
Director of the Complaints Department
The decision shall be final. Pursuant to Article 7(a) 2 of the Personal Data Protection Act of 10 May 2018 (Journal Of
Laws 2019, item 1781) in conjunction with Articles 13(2), 53(1) and 54 of the Proceedings before Administrative Courts
Act of 30 August 2002 (Journal of Laws Of Laws 2022, item 329 as amended), a party who is dissatisfied with this
decision has the right to lodge a complaint with the Provincial Administrative Court in Warsaw within 30 days of being
served on the party. The complaint is lodged via the President of the Personal Data Protection Office (address: Personal
Data Protection Office, ul. Stawki 2, 00-193 Warsaw). The entry for the complaint is PLN 200. A party has the right to
apply for exemption from court costs or for the right to aid.
5