[UNOFFICIAL TRANSLATION]
PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Jan Nowak
Warsaw, 16th January 2023
DS.523.2942.2020.ZS.BS
DECISION
On the basis of Article 104 § 1 of the Act of 14 June 1960 Code of Administrative
Procedure (consolidated text: Dz. U. [Journal of Laws] of 2022 item 2000 as amended)
and Article 7 (1) of the Act of 10 May 2018 on the personal data protection (consolidated
text: Dz. U. [Journal of Laws] of 2019 item 1781) and on the basis of Article 60 (6) and
(8) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27
April 2016 on the protection of natural persons with regard to the processing of personal
data and on the free movement of such data, and repealing Directive 95/46/EC (OJ L
119, 4.5.2016, p. 1, OJ L 127, 23.5.2018, p. 2 and OJ L 74, 4.3.2021, p. 35), after
carrying out the administrative proceedings regarding the complaint of
residing in Wrocław at represented by legal advisor
from . law firm based in Wrocław at
, relating to irregularities in the processing of
s residing in Wrocław at , personal data by
based in Munich at consisting in failure to comply
with the information obligation in accordance with Article 15 of the above-mentioned
Regulation, the President of the Personal Data Protection Office
dismisses the complaint.
JUSTIFICATION
The Personal Data Protection Office has received a complaint of
residing in Wrocław at , hereinafter: the Complainant,
represented by legal advisor
law firm based in Wrocław at relating to irregularities in the
processing of the Complainant’s personal data by based in
Munich at consisting in failure to comply with the information
obligation in accordance with Article 15 of the Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (OJ L 119, 4.5.2016, p. 1, OJ L 127, 23.5.2018, p. 2 and OJ
L 74, 4.3.2021, p. 35), hereinafter: the Regulation 2016/679.
According to Article 55 (1) of the Regulation 2016/679, each supervisory authority
shall be competent for the performance of the tasks assigned to and the exercise of the
powers conferred on it in accordance with this Regulation on the territory of its own
Member State. Moreover, Article 56 (1) states that without prejudice to Article 55, the
supervisory authority of the main establishment or of the single establishment of the
controller or processor shall be competent to act as lead supervisory authority for the
against the driver of the policyholder’s vehicle were also used to assess liability
and insurance risk. For this purpose, the Company applied for access to the files
to the competent investigative authority as part of legal representation in relation
to the insurance contract, as a civil liability insurer (proof: explanations of the
Company of 7th June 2021).
6. The Complainant applied to as the Company’s representative for
claims, for the payment of compensation for the harm suffered (proof: complaint of
27th May 2020).
7. The Complainant was covered by the additional , therefore
he also reported the damage to with its
registered office in Warsaw, hereinafter referred to as: in order to obtain
compensation. In order to carry out the liquidation of the damage, asked the
Complainant to present the documentation of the accident, including the police
report on the accident, under pain of refusal to pay the benefit (proof: complaint of
27th May 2020).
8. In February 2020, the Complainant, through asked the Company to
provide the police report on the accident in order to present it to for the
purpose of liquidating the damage. The company replied to that, for
legal reasons arising from German criminal law, it was not possible to make the
investigation files available to the Complainant. In the letter of 24th February 2020,
informed that the Company did not consent to the disclosure of the
police note due to the protection of personal data (proof: complaint of 27 th May
2020; letter of to the Complainant of 24 th February 2020 ;
explanations of the Company of 7th June 2021).
9. On 14th May 2021, the Company sent a letter to the Complainant with information
on the processing of his personal data. The company confirmed that it processes
the Complainant’s personal data. In addition, the Company provided the
Complainant with information about: stored data (along with a list of stored data),
processing purposes, recipients or categories of data recipients, the period of
personal data storage, the rights of the data subject and the right to lodge a
complaint with the supervisory authority and the origin of the data, provided that
they have not been collected from the data subject (proof: explanations of the
Company of 21st June 2021).
After reviewing the collected evidence, the President of the Personal Data
Protection Office considered the following.
According to the wording of Article 60 (3) of the Regulation 2016/679, the lead
supervisory authority shall, without delay, communicate the relevant information on the
matter to the other supervisory authorities concerned. It shall without delay submit a draft
decision to the other supervisory authorities concerned for their opinion and take due
account of their views. Where none of the other supervisory authorities concerned has
objected to the draft decision submitted by the lead supervisory authority within the
period referred to in paragraphs 4 and 5, i.e., respectively, four weeks for a draft decision
or two weeks for a revised draft decision, the lead supervisory authority and the
3
supervisory authorities concerned shall be deemed to be in agreement with that draft
decision and shall be bound by it (Article 60 (6) of the Regulation 2016/679).
As a rule, the lead supervisory authority shall adopt and notify the decision to the
main establishment or single establishment of the controller or processor, as the case
may be and inform the other supervisory authorities concerned and the European Data
Protection Board of the decision in question, including a summary of the relevant facts
and grounds, while the supervisory authority with which a complaint has been lodged
shall inform the complainant on the decision (Article 60 (7) of the Regulation 2016/679).
However, in accordance with Article 60 (8) of the Regulation 2016/679, by derogation
from paragraph 7, where a complaint is dismissed or rejected, the supervisory authority
with which the complaint was lodged shall adopt the decision and notify it to the
complainant and shall inform the controller thereof.
BayLDA, after conducting the proceedings regarding the submitted complaint,
acting pursuant to Article 60 (3) of the Regulation 2016/679, on 14th October 2022,
submitted a draft decision of 6th October 2022, to the other supervisory authorities
concerned, including the President of the Personal Data Protection Office, for their
opinion and take due account of their views. Within the four-week period referred to in
Article 60 (4) of the Regulation 2016/679, none of the other supervisory authorities
concerned has objected to the draft decision submitted by the lead supervisory authority.
The President of the Personal Data Protection Office, as the supervisory authority
concerned, is therefore bound by the draft decision of BayLDA of 6 th October 2022
pursuant to Article 60 (6) of the Regulation 2016/679. Due to the agreement reached by
the lead supervisory authority and the supervisory authorities concerned that the
complaint should be dismissed, in accordance with the disposition of Article 60 (8) of the
Regulation 2016/679, the President of the Personal Data Protection Office, as the
supervisory authority with which a complaint has been lodged, adopts this decision and
notifies it to the Complainant and informs the Company (data controller) thereof.
Considering the above, the President of the Personal Data Protection Office
agreed with the decision, factual findings and legal justification presented by BayLDA in
the draft decision of 6th October 2022 and accepted them as his own.
When issuing an administrative decision, the President of the Personal Data
Protection Office is obliged to settle the case based on the facts existing at the time of
issuing the decision. As stated in the doctrine, “the public administration authority
assesses the facts of the case at the time of issuing the administrative decision. This rule
also applies to the assessment of the legal status of the case, which means that the
public administration body issues an administrative decision on the basis of the
provisions of law in force at the time of its issuance (…). Settling in administrative
proceedings consists in applying the applicable law to the established facts of the
administrative case. In this way, the public administration body achieves the goal of
administrative proceedings, which is the implementation of the applicable legal norm in
the field of administrative and legal relations, when these relations require it”
(Commentary to the Act of 14 June 1960, Code of Administrative Procedure M.
Jaśkowska, A. Wróbel, Lex., el/2012). At the same time, this authority shares the position
expressed by the Supreme Administrative Court [Naczelny Sąd Administracyjny] in the
4
judgment of 25th November 2013, issued in the case with reference number I OPS 6/1, in
which the above-mentioned Court indicated as follows: “In administrative proceedings,
regulated by the provisions of the Code of Administrative Procedure, the rule is that the
public administration body settles the case by issuing a decision that settles the case as
to its essence, according to the legal and factual status as at the date of the decision”.
First of all, it should be pointed out that the administrative proceedings conducted
by the President of the UODO are to control the compliance of data processing with the
provisions on the protection of personal data and are aimed at restoring the lawful state
by issuing an administrative decision pursuant to Article 58 (2) of the Regulation
2016/679.
In the judgment of 7th May 2008 in the case with reference number I OSK 761/07,
the Supreme Administrative Court [Naczelny Sąd Administracyjny] stated that “when
examining [...] the lawfulness of personal data processing, GIODO is obliged to
determine whether, as of the date of issuing a decision in the case, the data of a specific
entity is processed and whether it is done in a lawful manner”.
Pursuant to Article 15 (1) of the Regulation 2016/679, the data subject shall have
the right to obtain from the controller confirmation as to whether or not personal data
concerning him or her are being processed, and, where that is the case, access to the
personal data and the following information: (a) the purposes of the processing; (b) the
categories of personal data concerned; (c) the recipients or categories of recipient to
whom the personal data have been or will be disclosed, in particular recipients in third
countries or international organisations; (d) where possible, the envisaged period for
which the personal data will be stored, or, if not possible, the criteria used to determine
that period; (e) the existence of the right to request from the controller rectification or
erasure of personal data or restriction of processing of personal data concerning the data
subject or to object to such processing; (f) the right to lodge a complaint with a
supervisory authority; (g) where the personal data are not collected from the data
subject, any available information as to their source; (h) the existence of automated
decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in
those cases, meaningful information about the logic involved, as well as the significance
and the envisaged consequences of such processing for the data subject.
Article 15 (3) of the Regulation 2016/679 states, that the controller shall provide a
copy of the personal data undergoing processing. For any further copies requested by
the data subject, the controller may charge a reasonable fee based on administrative
costs. Where the data subject makes the request by electronic means, and unless
otherwise requested by the data subject, the information shall be provided in a commonly
used electronic form.
The collected evidence shows that in February 2020, the Complainant, through
asked the Company to provide a police note from the accident, which was
supposed to contain his personal data, in order to present it to for the purpose of
liquidating the damage. However, the evidence does not show that the Complainant
requested the Company to provide information pursuant to Article 15 (1) of the
Regulation 2016/679. Request to fulfill the information obligation towards the
Complainant by indicating: what personal data concerning the Complainant were
5
processed, what were the purposes of processing, how long the data will be stored and
to which recipients the Complainant’s data have been or will be disclosed, and request to
provide the Complainant with a copy of his personal data subject to processing, were
formulated only in the letter of the Complainant’s attorney of 31 st July 2020, addressed to
the President of the UODO. Therefore, it should be assumed that the Company received
the above-mentioned requests together with the letter of BayLDA dated 21st April 2021
addressed to the Company.
According to Article 12 (3) of the Regulation 2016/679 the controller shall provide
information on action taken on a request under Articles 15 to 22 to the data subject
without undue delay and in any event within one month of receipt of the request. That
period may be extended by two further months where necessary, taking into account the
complexity and number of the requests. The collected evidence clearly shows that the
Company responded to the Complainant’s request for access to the processed data
within the prescribed period and provided him with a copy of his personal data subject to
processing. The Company submitted proof of the fact that on 14 th May 2021 it provided
the Complainant with information pursuant to Article 15 (1) of the Regulation 2016/679
and provided him with a copy of his personal data subject to processing, as requested by
the Complainant’s attorney in the letter of 31st July 2020, addressed to the President of
the UODO, which was received by the Company on 21 st April 2021. With regard to the
above, the authority states that the Complainant’s allegations are not supported by the
evidence, because the Company has presented evidence for the timely and reliable
fulfillment of the controller’s obligations and exercising the Complainant’s right to obtain
information pursuant to Article 15 (1) of the Regulation 2016/679 and provided the
Complainant with a copy of the personal data subject to processing in accordance with
Article 15 (3) of the Regulation 2016/679.
Referring to the Complainant’s allegation regarding the Company’s refusal to
provide a copy of the police note from the accident involving the Complainant, which took
place on 15th October 2019 in Germany, BayLDA in the draft decision of 6th October
2022, followed by the President of the Personal Data Protection Office, being bound by
the content of the draft decision pursuant to Article 60 (6) of the Regulation 2016/679,
determined that the Complainant’s request in this respect is manifestly unfounded.
The right to request access to personal data by the data subject is not
unconditional. According to Article 15 (4) of the Regulation 2016/679, the right to obtain a
copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of
others. On the other hand, the Article 12 (5) of the Regulation 2016/679 states that
where requests from a data subject are manifestly unfounded or excessive, in particular
because of their repetitive character, the controller may, among others, refuse to act on
the request.
The police note from the accident involving the Complainant, which took place on
15th October 2019 in Germany, is part of the police files, in relation to which the issue of
access to documents is regulated by the provisions of German criminal procedure law.
The right of access to the file is granted only within the narrow limits laid down in the
provisions of the German Code of Criminal Procedure (StPO), expressly defined for this
purpose by the German legislator and not against the insurance company, but against
the competent investigating authority. The Company requested access to the file, taking
6
advantage of its subjective legal position as an insurer, which is an “other entity” under
Article 475 of the German Code of Criminal Procedure (StPO). The investigating
authority, recognizing the Company’s procedural rights, allowed the Company to
exercise its right of access to files.
According to Article 32f (5) of the German Code of Criminal Procedure (StPO),
persons who have been granted access to files are prohibited from distributing files,
documents, printouts or copies obtained from them, passing them on to third parties for
non-procedural purposes or otherwise making them available.
Pursuant to Article 23 (1)(d) of the Regulation 2016/679, Union or Member State
law to which the data controller or processor is subject may restrict by way of a
legislative measure the scope of the obligations and rights provided for in Articles 12 to
22 and Article 34, as well as Article 5 in so far as its provisions correspond to the rights
and obligations provided for in Articles 12 to 22, when such a restriction respects the
essence of the fundamental rights and freedoms and is a necessary and proportionate
measure in a democratic society to safeguard, among others, the prevention,
investigation, detection or prosecution of criminal offences or the execution of criminal
penalties, including the safeguarding against and the prevention of threats to public
security.
Considering the above, the authority concluded that pursuant to Article 23 (1)(d) of
the Regulation 2016/679, the provision of Article 32f (5) of the German Code of Criminal
Procedure (StPO) constitutes a lawful limitation of the scope of the obligations and rights
provided for in Article 15 of the Regulation 2016/679. The Company was under an
obligation to refuse to provide the Complainant with a copy of the police report of the
accident, as otherwise it would be subject to criminal liability for a violation of Article 32f
(5) of the German Code of Criminal Procedure (StPO).
Just as an aside, the authority notes that the Complainant, who is granted the
status of a victim of the accident under investigation by the provisions of the German
Code of Criminal Procedure (StPO), should be entitled to access police files. However,
the request for access to the files should be addressed to the investigating authority
conducting the proceedings, and not – as was in this case – to the insurer (the
Company).
Administrative proceedings conducted by the President of the Personal Data
Protection Office are to control the compliance of data processing with the provisions on
the protection of personal data and are aimed at issuing an administrative decision
pursuant to Article 58 of the Regulation 2016/679, on the basis of which the supervisory
authority may restore the lawful state. In the case in question, it was established that
there was no violation of the Complainant’s rights under Article 15 (1) and (3) of the
Regulation 2016/679. The Company responded to his request within the deadlines, and
thus the allegation made by the Complainant against the Company was not confirmed. In
addition, the Company, in accordance with Article 12 (5)(b) of the Regulation 2016/679,
reasonably refused to take action in connection with the Complainant’s request to
provide a copy of the police note from the accident, due to its manifestly unfounded
nature, having regard the compliant with Article 23 (1)(d) of the Regulation 2016/679
limitation of the scope of obligations and rights provided for in Article 15 of the Regulation
7
2016/679 resulting from the provision of Article 32f (5) of the German Code of Criminal
Procedure (StPO). In view of the above, there are no grounds for applying corrective
measures aimed at restoring the lawful state. Considering the above, the President of the
Personal Data Protection Office decided to dismiss the complaint.
In this factual and legal state, the President of the Personal Data Protection Office
decided as in the sentence.
Under the authority of the President
of the Personal Data Protection Office
the Head of the Complaints Department
The decision is final. Based on Article 7 (2) of the Act of 10 May 2018 on the
personal data protection (consolidated text: Dz. U. [Journal of Laws] of 2019 item 1781)
and in connection with Article 13 § 2, Article 53 § 1 and Article 54 of the Act of 30 August
2002 Law on proceedings before administrative courts (consolidated text: Dz. U. [Journal
of Laws] of 2022, item 329, as amended), the party has the right to lodge a complaint
against this decision to the Provincial Administrative Court in Warsaw [Wojewódzki Sąd
Administracyjny w Warszawie], within 30 days from the date of delivery of this decision,
through the President of the Personal Data Protection Office (address: Urząd Ochrony
Danych Osobowych, ul. Stawki 2, 00 - 193 Warsaw). The court fee for a complaint is
PLN 200. The party has the right to apply for the right of assistance.
8