TRANSLATION
PRESIDENT OF THE PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw,14 May 2025
ZSPR.440.1562.2019.
DECISION
Pursuant to Article 104 § 1 and Article 105 of the Act of 14 June 1960 Code of
Administrative Procedure (Journal of Laws 2024, item 572) (hereinafter: k.p.a.), Article
7(1) of the Act of 10 May 2018 on the personal data protection (Journal of Laws 2019,
item 1781), Article 6(1)(f) and Article 60(8) Regulation (EU) 2016/679 of the European
Parliament and of the Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free movement of such data, and
repealing Directive 95/46/EC (General Data Protection Regulation) (Journal of Laws EU
L. of 2016, No 119, p. 1 as amended) (hereinafter: GDPR), regarding the complaint of
(residence: )
(hereinafter: Complainant) concerning irregularities in the processing of the
Complainant’s personal data by – (Germany)
with its registered office in
(hereinafter: ) consisting in the unauthorized transfer of his data in the
scope of name, surname, address and health data contained in the letter of 5 December
2018 sent to with its registered office in
(hereinafter: ) in which the Complainant requests the President of
the Personal Data Protection Office to oblige to reply to the Complainant's
letter of 5 December 2018 or to submit a authorization to provide the Complainant with
a reply by , and to issue a reprimand pursuant to Article 58(2)(b) of
the GDPR to and , President of the Personal Data
Protection Office
1) dismisses the complaint in the scope of request to issue a reprimand
pursuant to Article 58(2)(b) of the GDPR to and
for disclosing and processing personal data in the scope of the
name, surname and address of residence contained in the Complainant's
letter of 5 December 2018, obliging to respond to the
Complainant's letter of 5 December 2018 and obliging to
submit a authorization to provide the Complainant with a response by
;
2) discontinues the proceedings regarding the request to issue a reprimand
pursuant to Article 58(2)(b) of the GDPR to and
for disclosing and processing personal data in the scope of the
Complainant's health data contained in the Complainant's letter of 5
December 2018.
JUSTIFICATION
The Personal Data Protection Office (hereinafter: the Office) received a complaint
from the Complainant concerning irregularities in the processing of his personal data by
consisting in the unauthorized transfer of his data to
as regards the name, surname, address and health data contained in the Complainant's
letter addressed to on 5 December 2018
In the complaint, the Complainant requested the President of the Personal Data
Protection Office to oblige to reply to the letter of 5 December 2018 or to
submit a authorization to provide the Complainant with a reply by
and to reprimand both entities.
During the administrative proceedings, the President of the Office established the
following facts:
1. The Complainant indicated that on 5 December 2018 he sent a letter to
in which he included his personal data, including health data, with a
view to pursuing compensation claims related to an accident he had suffered at
the store in . The letter contained data such as the name, surname,
address of residence and detailed information on the Complainant's state of
health, including a description of the injury, the course of treatment and medical
records. The Complainant stated that his purpose was to obtain compensation
for the damage suffered. The Complainant pointed out that he had decided to
contact the headquarters in Germany because “’ ; did not accept
liability for the damage, did not make the third party liability insurer’s data
available contrary to the obligation,’. (evidence: Complainant’s letters of 20 June
2019, 27 August 2019, 15 June 2020 and 14 October 2020)
2. By letter of 21 December 2018, informed the Complainant
that the Complainant’s claim was time-barred. That letter also stated that the
matter had been consulted between the Headquarters in Germany and the
Headquarters in Poland and that the Complainant would not receive a reply
directly from the Headquarters in Germany. (evidence: Annex to the
Complainant’s letter of 20 June 2019)
3. The Complainant indicated that on 9 January 2019 he requested
to provide a copy of the authorization giving authority to reply to the
Complainant’s correspondence addressed to and that he had not
received a reply to it. (evidence: Complainant’s letter of 20 June 2019)
4. The President of the Office identified the case as being of a cross-border nature
in accordance with Article 4(23) of the GDPR and on 15 January 2020 via the
Information Exchange System on the Internal Market (hereinafter: IMI) referred
the matter to the German supervisory authority of the Land of Baden-
Württemberg (German: Landesbeauftragte für den Datenschutz und die
Informationsfreiheit Baden-Württemberg) (hereinafter: LfDl), who accepted the
2
case as lead supervisory authority. On 19 February 2020, the LfDI considered
itself to be the lead supervisory authority competent to handle the case within the
meaning of Article 56(1) of the GDPR and asked the President of the Office for
information on the purpose for which the Complainant contacted .
(evidence: A56ID notification report No 102174.1 of 7 May 2020)
5. The supervisory authorities of Denmark, Sweden, Slovakia, Spain, Italy, France
and the supervisory authorities of the Länder of Hessen, Lower Saxony,
Mecklenburg-Vorpommern and Rhineland-Palatinate have identified themselves
as supervisory authorities concerned. (evidence: A56ID notification report No
102174.1 of 7 May 2020)
6. The President of the Office sent a letter to the Complainant asking for clarification
as to why the Complainant had sent a letter containing health data to
. (evidence: letter from the President of the Office of 21 May 2020)
7. The Complainant indicated that he had sent a letter to due to the
lack of compensation for the accident at the shop in . In his letter to
of 5 December 2018, the complainant referred, inter alia, to the
following: ‘I would be grateful if you could influence the management board of
your daughter company’ ’, which will lead
to a change in your current position and the assumption of liability for the
damage, since the action described below violates the principles of social
coexistence and jeopardises the good name of the well-known German company
’ The complainant also points out in his letter to that ‘on 6
February 2015 I asked to assume
responsibility for the damage’ (evidence: Complainant’s letters of 15 June 2020
and 14 November 2020)
8. On 1 September 2020, the President of the Office contacted LfDI to obtain
information on the status of the case via IMI. In its reply of 1 October 2020, the
LfDI stated that the information that ‘it was a question of compensation’ did not
explain what data the Complainant had provided to the controller and why it had
done so. LfDI indicated that without this information it is not in a position to
assess whether the transfer of data between and the Polish branch
was in compliance with the provisions on the protection of personal data. In view
of the above, LfDI requested to contact the Complainant again in order to clarify
the circumstances of the case, including clarifying the Complainant's relationship
with the controller (whether he was an employee, a client, why he wrote to
Germany and not to Poland), as well as providing the background to the case
(why he sent the letter and what its content was). LfDI requested that
correspondence between the Complainant and the controller be forwarded.
(evidence: 61VMN notification report No 147654.1 of 6 October 2020)
9. In response to LfDI’s request, on 8 October 2020 the President of the Office sent
the Complainant questions concerning the relationship with the controller. In his
reply of 14 October 2020, the complainant indicated that he was not an
3
employee, but a customer, and that the reason for referring the case to
was the lack of reaction of the Polish entity and the failure to provide
the data of the third party insurer. The complainant communicated the content of
the letter and indicated that he had sent the name, surname, address of
residence, as well as special category data on health, including information on
multiple fractures of the left leg and staphylococcus implantation. (evidence: a
letter from the President of the Office on 8 October 2020; Complainant’s letter of
14 October 2020)
10. On 16 October 2020, the President of the Office provided LfDl with a translation
of the Complainant’s letter. The President of the Office stressed that the
complaint concerns the legality of the transfer of personal data between the
controller and the establishment in Poland and asked LfDl to conduct
proceedings in this regard. (evidence: 61VMN notification report No 147654.1 of
16 October 2020)
11. The President of the Office asked the LfDl for information on the status of the
case via the IMI system in 61VMN notifications: 363213.1 (2 February 2022),
379086.1 (16 March 2022), 449265.1 (19 October 2022). The LfDI did not reply
to notifications 363213.1 and 379086.1. In response to notification 449265.1, the
LfDI informed that there was currently no new information to be provided on the
progress of the case. (evidence: 61VMN notification reports numbered 363213.1,
379086.1, 449265.1)
12. The President of the Office kept the Complainant informed of the state of play of
the case by sending letters to the Complainant dated 3 November 2022 and 13
July 2023, in which the President of the Office explained that LfDl had not
provided any new information and that the case was still ongoing. (evidence:
letters of the President of the Office of 3 November 2022 and 13 July 2023)
13. On 21 August 2023, within notification 60IC 549308.1, the LfDI submitted a
preliminary draft decision to close the case. In the notification, LfDI indicated that
the draft decision was issued on the basis of Article 60(8) of the GDPR. The
President of the Office has translated the content of the draft decision, the
content of which is hereby presented:
DRAFT DECISION
Dear ,
Having examined the facts of the case, we turn to you in relation to your complaint
under the above-mentioned reference number
Complaint by , ref: 4400-5/88 (UODO ref: ZSPR.440.1562.2019)
I. The course of the procedure
On 20 June 2019, the complainant lodged a complaint with the Polish Personal Data
Protection Office (hereinafter: UODO). He claimed that he had sent a letter to
(hereinafter: the respondent), containing
4
personal data, including health data about himself. In response, he had received a
letter from (hereinafter: ). The complainant
considers that the respondent was not authorized to disclose his personal data to
. On 15 January 2020, the UODO initiated a procedure to establish the
lead supervisory authority (LSA) in accordance with Article 56 of the General Data
Protection Regulation (hereinafter: GDPR) and submitted the complaint via IMI (no.
102174). On 19 January 2020, the Baden-Württemberg DPA (hereinafter: DE/BW
DPA) confirmed to act as LSA in this case, due to the respondent’s establishment in
Neckarsulm, Baden-Württemberg and launched an investigation based on the
complaint pursuant to Article 57(1)(f) of the GDPR. On 22 April 2020, the DE/BW
DPA created a case register in IMI (no. 1222324). On 1 September 2020 DE/BW
DPA contacted UODO via IMI 61 (no. VMN 147654) asking for more information
about the facts of the complaint. UODO informed that the complainant issued health
data to (Germany) in order to seek compensation from the controller.
Furthermore, UODO provided information on the background of why the complainant
had sent health data to the respondent. UODO had received this information upon
request from the complainant on 14 October 2020. The DE/BW DPA contacted the
on behalf of the respondent in a letter
dated 8 February 2021 and received a detailed response dated on 19 April 2021.
After further exchange between the UODO and DE/BW DPA on the state of the case
via Article 61 procedures in IMIDE/BW DPA hereby presents the draft decision to the
CSAs as per Article 60(3) GDPR.
II. Facts of the case
The complainant claims that the respondent was not authorized to disclose his
personal data to . - 3 - On 20 June 2019, the complainant addressed the
UODO. In his complaint, he described that on 5 December 2018, he sent a letter to
the respondent containing personal data, including health data about himself. The
purpose of this letter was to assert liability claims based on an accident suffered by
the complainant on the premises of a store in , Poland. In response, he
had received a letter from on 21 December 2018, which stated
that the letter was the official position of the , to which belong i.e.
in Poland and in Germany. By letter dated January 9, 2019, the
complainant asked to submit a authorization that would authorize the
correspondence on behalf of , but received no response. Based on
this, the complainant assumed that the respondent had illegally passed on personal
data to third parties (in this case to ). The DE/BW DPA contacted the
on behalf of the respondent in a letter dated 8
February 2021. (hereinafter: )
replied in detail on 19 April 2021. They explained that each of the different
companies were operating as separately accountable, including as separate
controllers under data protection law and that was answering for all the
companies involved. On the facts of the case, they informed us that the
complainant contacted both and in December
5
2018. A statement from the complainant to the Polish DPA in response to a letter
from the DPA from 8 October 2020 confirms this fact, as the complainant states
therein that he has “contacted the headquarters of because did not
recognize its liability for the damage” and that “letter to the controller consist[ed] of
Name, surname, residence address and sensitive data relating to [his] health
condition”. Subsequently, after coordination involving both companies, the two
entities agreed that would assess the matter and handle the
correspondence with the complainant. did so by letter to the
complainant dated 21 December 2018. has erased the
complainant’s personal data. At the moment, both and
process the complainant’s personal data based
on article 6 (1) phrase 1 (f) GDPR, in the context of defence against legal claims, as
well as for compliance with legal obligations in the context of the proceedings before
the Supervisory Authority. - 4 - According to the statement made by , and
as confirmed by the statement from the complainant to the Polish DPA (see above),
the complainant sent his compensation claim letter to both , and
to .
III. The findings of the Authority
The complainant sent identical compensation claim letters with the same personal
data about his accident to and the respondent. He subsequently
complained to UODO that the respondent transferred his letter – supposedly in
violation of the GDPR – to in Poland. However, our
assessment on the facts of the case revealed that it was in fact the complainant
himself who revealed his personal data to , by the letter he sent
to their office on 5 December 2018. Therefore, was already in
possession of the complainant’s personal data surrounding his accident by the time
and coordinated regarding the question
which company was better suited to correspond with the complainant. While, under
these circumstances, the DE/BW DPA might have also considered a refusal to act
on the request due to a manifestly unfounded request of the Complainant as per
Article 57(4) GDPR, in any case, our assessment did not reveal any unlawful
transfer of personal data by . We therefore find that there was
no infringement of the GDPR.
IV. Legal consequences
In lack of an infringement of the General Data Protection Regulation, the
Commissioner for Data Protection and Freedom of Information Baden-Württemberg
considers the case closed.
14. In addition, as part of notification 60IC No 549308.1, LfDI forwarded to the
President of the Office a letter of 19 March 2021 from
to LfDI. The President of the Office has translated the content of
the above-mentioned letter, the content of which is hereby presented:
6
Dear [name of case officer],
regarding your letter dated 8 February 2021, we would like to thank you again for
granting the extension of the deadline. First, we would like to point out the following
aspects:
does not operate any branches in
Poland;
• the branches in Poland are operated by ;
• the different companies each operate as separately accountable, including as
separate controllers under data protection law;
• to speed up the proceedings, takes on
answering your letter for the companies involved. In this regard, we refrain from
pointing out lack of competence, which would delay the proceedings. That said, we
make the following statement with regard to the complainant’s account:
1. Facts of the case
The facts of the case, as displayed in no. I of your letter, are not correct. The
complainant did not write to in this matter.
Rather, the complainant contacted and . In
this respect, both companies received letters dated 5 December 2018 and with the
same content. Afterwards, both companies coordinated as to which company would
address the concerns and write the answer. During the course of this coordination,
the companies exchanged the complainant’s master data and general information on
the facts of the case. This coordination did not involve health data of the
complainant. However, both companies were already in possession of these [health
data] anyway, because of the letter from the complainant with the same content.
2. Data concerned The companies involved stored the following data about the
complainant:
• : surname, first name, address, phone number, email
address, bank account number, data about the health impairment / rehabilitation;
dates about the injury incident, and signature.
• : according to the departments asked, no data about the
original issue are available anymore. The data from the exchange with
and the letter of 5 December 2018 have been erased.
• : surname, first name, address,
information about the facts of the case from your letter of 8 February 2021.
The legal basis for the processing of the aforementioned data is Article 6 (1) 1 f)
GDPR. In this regard, processing the data for the defence of legal claims, as well
as to demonstrate compliance with the legal requirements in the context of your
supervisory authority data protection review, constitute a legitimate interest under
this provision.
7
The data date to the complainant’s letter of 5 December 2018 and to your letter
of 8 February 2021. The data processing occurred solely for the aforementioned
purposes. There was no transfer to other third parties.
3. Data erasure concept
The data mentioned under no. 2 will be erased according to the following criteria:
• : the data will be erased ten years after the end of the
compensation proceedings, i. e. in this case with expiry of [the day of] 11 January
2029.
• : the data from the supervisory
authority data protection review will be erase three years after the end of the
proceedings. The storage takes place to demonstrate that the legal requirements
have been met.
There are no data with relevance under trade or tax law regarding
.
Yours sincerely,
[CEO signature]
(evidence: 60IC notification report No 549308.1, memo of 19 September 2023
15. The President of the Office, in response to the preliminary draft decision of the
LfDI, indicated that he agreed with the LfDI as regards the absence of
unauthorized disclosure of data in the present case. The President of the Office
asked LfDI to consider the possibility of issuing a decision on the basis of Article
60(7) of the GDPR. In addition, the President of the Office asked LfDI to indicate
precisely in the draft decision that no data had been made available between the
German and Polish entities. The President of the Office further stressed that if
LfDI is in possession of a document confirming the authorization granted by a
German entity to a Polish entity in order to reply to the Complainant, this
document should be forwarded to the President of the Office in order to complete
the case file. (evidence: memo of 19 September 2023)
16. By letter of 8 February 2024, LfDI responded to the above observations of the
President of the Office and provided the following:
i. according to the facts of the case (preliminary draft decision, section II)
and the letter from of 19 March
2021, the Complainant’s personal data (basic data, general information)
were exchanged to ensure coordination. Therefore, the requested
statement cannot be included in the draft decision as it would not reflect
the actual facts;
ii. the case must be closed in accordance with Article 60(8) of the GDPR.
According to the EDPB Guidelines 02/2022 on the application of Article 60
GDPR, Article 60(8) of the GDPR is the appropriate legal provision to
8
conclude the case. Therefore, the LfDI sees no grounds to comply with the
request to close the case under Art. 60(7) of the GDPR;
iii. LfDI is not in possession of a document authorising to reply on
behalf of . According to a letter from
dated 19 March 2021, it deleted all information that was
exchanged for the purpose of coordination between and
. Therefore, LfDI is not in a position to provide the required
document.
17. The President of the Office accepted the preliminary draft decision and did not
provide LfDI with additional comments on the draft decision (evidence: Memo of
21 February 2024)
18. On 9 April 2024, LfDI submitted to the President of the Office notification 60DD
626110.1, by which it submitted an official draft decision on the case. In the
notification, LfDI indicated that the draft decision was issued on the basis of
Article 60(8) of the GDPR. The content of the draft decision is identical to the
preliminary draft decision submitted under 60IC number 549308.1 (evidence:
60IC notification report 6226110.1, memo of 13 May 2024)
After examining all the evidence gathered in the case, the President of the Office
weighed the following.
In accordance with Article 56(1) of the GDPR, the supervisory authority of the
main establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried
out by that controller or processor in accordance with the procedure provided in Article
60. Pursuant to Article 60(3) of the GDPR, the lead supervisory authority shall, without
delay, communicate the relevant information on the matter to the other supervisory
authorities concerned. It shall without delay submit a draft decision to the other
supervisory authorities concerned for their opinion and take due account of their views. .
In accordance with Article 60(6) of the GDPR where none of the other supervisory
authorities concerned has objected to the draft decision submitted by the lead
supervisory authority within the period referred to in paragraphs 4 and 5, the lead
supervisory authority and the supervisory authorities concerned shall be deemed to be
in agreement with that draft decision and shall be bound by it.
In accordance with Article 60(7) of the GDPR the lead supervisory authority shall
adopt and notify the decision to the main establishment or single establishment of the
controller or processor, as the case may be and inform the other supervisory authorities
concerned and the Board of the decision in question, including a summary of the
relevant facts and grounds. The supervisory authority with which a complaint has been
lodged shall inform the complainant on the decision. However, pursuant to Article 60(8)
of the GDPR, by derogation from paragraph 7, where a complaint is dismissed or
rejected, the supervisory authority with which the complaint was lodged shall adopt the
decision and notify it to the complainant and shall inform the controller thereof. .
The above-mentioned provisions have been analyzed by the European Data
Protection Board (hereinafter: the EDPB), which states in paragraph 225 of Guidelines
9
02/2022 on the application of Article 60 GDPR, “Thus, a decision dismissing or rejecting
a complaint (or parts of it) should be construed as a situation where the LSA has found,
in handling the complaint, that there is no cause of action regarding the complainant's
claim, and no action is taken in relation to the controller. In such case, the complaint has
to be dismissed or rejected via the decision adopted by the complaint receiving SA, as
the case may be."
EDPB in the above mentioned guidelines further states in point 238 that "The
CSA, when issuing a decision, must give full effect to the draft decision, which is binding
on LSA and other CSAs under Article 60(6) and/or the EDPB binding decision following
Article 65(1)(a).”
The LfDI, acting as lead supervisory authority pursuant to Article 56(1) GDPR,
transmitted on 9 April 2024, pursuant to Article 60(3) GDPR, a draft decision under
notification 60DD number 626110.1. Within this notification, the LfDI indicated that the
draft decision is issued in accordance with Article 60(8) GDPR. The President of the
Office accepted the draft decision and did not express any reasoned and relevant
objection to it. Having regard to the content of Article 60(6) GDPR, this means that the
President of the Office has agreed with the LfDI on the draft decision and is bound by it.
Pursuant to Article 60(8) GDPR, the President of the Office, as the authority with
which the complaint was lodged, is competent to adopt the final decision on the case,
notify it to the Complainant and inform the controller, i.e. .
It should also be emphasized that the GDPR lays down the obligations of the
controller, which include the processing of personal data in accordance with the
conditions laid down in that regulation. The provision entitling controllers to process data
of natural persons is Art. 6(1) GDPR, according to which data processing is permissible
only if one of the conditions set out in that provision is met. Catalogue of the grounds
listed in Article 6(1) GDPR is closed. Each of the conditions that legalize the processing
of personal data is autonomous and independent. This means that these conditions are,
in principle, equal, and therefore the fulfilment of at least one of them constitutes lawful
processing of personal data.
Article 6(1)(f) GDPR provides that the processing of personal data is permissible
if it is necessary for the purposes of the legitimate interests pursued by the controller or
by a third party, except where such interests are overridden by the interests or
fundamental rights and freedoms of the data subject which require the protection of
personal data.
As explained by on 19 March 2021, the
Complainant sent letters of 5 December 2018 with the same content to
and . In order to coordinate their response to the
Complainant, those entities exchanged basic data of the Complainant and general
information on the facts of the case. As points
out, that coordination did not include the applicant’s health data. However, it should be
emphasized that the entities were already in possession of the data concerning the
Complainant’s health due to the fact that the Complainant sent letters with the same
content to both entities.
10
In response to the Complainant’s letter of 5 December 2018,
took coordination measures with to determine which of the
entities should continue correspondence on claims for damages.
By letter of 21 December 2018, informed the Complainant
that the letter was an official position of the . It should be concluded that
these actions were aimed at ensuring a uniform position in the case and the efficient
implementation of the response to the Complainant's claims, as confirmed by the
evidence collected.
The Complainant requests the President of the Office to reprimand the
entities involved in the coordination of responding to the Complainant's letter of 8
December 2018. In the present case, the processing of the Complainant's personal data
by the entities of the took place for the purpose of defending against
claims and in the course of correspondence related to the compensation proceedings.
Therefore, it must be concluded that the processing of the Complainant's personal data
in the scope of Complainant's basic data and general information on the facts of the
case is supported by the premise set out in Article 6(1)(f) of the GDPR, as it is
necessary for the explanatory actions in the framework of correspondence related to the
compensation proceedings. In view of the above, it should be concluded that the
Complainant's complaint with regard to the request that the President of the Office
issues a reprimand pursuant to Article 58(2)(b) of the GDPR for disclosing and
processing personal data by and in the scope of the
first name, last name and residential address contained in the letter of 5 December
2018 should be dismissed.
As regards the Complainant’s allegation that provided
with data on the Complainant’s state of health, it should be noted that the
evidence shows that the coordination between and
in order to reply to the Complainant did not include data on the Complainant’s
state of health. Both entities were in possession of the data concerning the
Complainant’s health due to the fact that they received the Complainant’s letter of 5
December 2018, but did not transfer those data to each other in order for
to reply on 21 December 2018.
In the light of the above, the President of the Office concluded that the
Complainant’s personal data in the field of health data had not been made available to
an unauthorized entity, as a result of which the processing process contested by the
Complainant did not exist and the proceedings in this regard isare subject to
discontinuation pursuant to Article 105 § 1 of the Code of Administrative Procedure.
Under that provision, where, for whatever reason, a procedure has become devoid of
subject in whole or in part, the public authority is to take a decision to discontinue the
procedure in whole or in part, as appropriate. The wording of that provision leaves no
doubt that, if it is found that the proceedings are devoid of subject, the authority
conducting those proceedings is obliged to discontinue them. At the same time, the
literature on the subject indicates that the proceeding becoming devoid of subject, as
provided for in Article 105 § 1 of the Code of Administrative Procedure, means that one
of the elements of a substantive legal relationship is missing, and therefore it is not
11
possible to issue a decision resolving the case by ruling on its merits (B. Adamiak, J.
Borkowski, ‘Code of Administrative Procedure. Commentary’ 7th edition, C.H. Beck
Publishing House, Warsaw 2005, p. 485). The same position was taken by the
Voivodship Administrative Court in Kraków in its judgment of 27 February 2008 (III
SA/Kr 762/2007): ‘[t]he proceedings become devoid of subject when one of the
elements of the substantive legal relationship is missing, which means that the case
cannot be resolved by a decision on the merits’.
Determination by a public authority of the existence of the condition referred to in
Article 105 § 1 of the Code of Administrative Procedure obliges it, as emphasized in
legal literature and case-law, to discontinue the proceedings, because there are no
grounds for resolving the case on the merits, and the continuation of the proceedings in
such a case would constitute its defectiveness, having a significant impact on the
outcome of the case.
The administrative procedure conducted by the President of the Office serves to
control the compliance of data processing with the provisions on the protection of
personal data and is aimed at issuing an administrative decision restoring the lawful
state pursuant to Article 58(2) of the GDPR. The assessment carried out by the
President of the Office in each case serves to examine the justification for issuing an
order to a specific entity corresponding to the instruction of Article 58(2) of the GDPR to
restore the lawful state in the processing of data – it is therefore justified and necessary
only in so far as irregularities in the processing of personal data exist. In the present
case, the authority has no grounds to issue and with
any of the corrective powers specified in Article 58(2) of the GDPR. The authority has
the power to adopt such a decision only if there has been a breach of the rules on the
protection of personal data, which is not the case here.
In view of the above, the President of the Office dismisses the Complainant's
request for an reprimand under Article 58(2)(b) of the GDPR to and
for the disclosure and processing of personal data in respect of the first
name, surname and residential address contained in the letter of 5 December 2018, as
he found no infringement of data protection legislation in this respect. Furthermore, with
regard to the request for a reprimand on the basis of Article 58(2)(b) RODO of the
disclosure and processing by and of data concerning
the Complainant's health, the authority discontinues the proceedings on the grounds
that they are devoid of subject.
With regard to the Complainant’s request that the President of the Office require
to submit an authorization to provide the Complainant with a reply from
to the Complainant’s letter of 5 December 2018, it should be noted,
first of all, that it is apparent from
explanations of 19 March 2021 that and
coordinated together the manner of responding to the Complainant’s letters of 5
December 2018. Therefore, it must be agreed that, as indicated in
its letter to the Complainant of 21 December 2018 that ‘the case was consulted between
the Headquarters in Germany and the Headquarters in Poland’ and that the letter
received by the Complainant is ‘the official position of the , which
12
includes, inter alia, in Poland and in Germany.’, as confirmed by
the explanations of of 19 March 2021. It is
clear from the explanations of that the
cooperation resulted in the authorization of to reply to the
Complainant’s letter. Furthermore, it should be recalled that was
already in possession of the facts of the case following the letters of 5 December 2018
sent to both and . In view of the above, it must
be concluded that , as a result of cooperation between the entities of
the , duly replied on behalf of the to the Complainant’s
letter of 5 December 2018.
In the light of the above, the Complainant’s complaint concerning the request for
the President of the Office to oblige to submit an authorization to provide
the Complainant with a reply by is dismissed.
With regard to the Complainant's request that the President of the Office orders
to respond to the Complainant's letter sent to on 5
December 2018, it should be pointed out that pursuant to Article 55 of the GDPR, the
President of the Office is competent to perform the tasks and exercise the powers
conferred on it pursuant to that regulation on the territory of Poland; moreover, pursuant
to Article 57(1)(f) of the GDPR, the authority shall examine complaints lodged, inter alia,
by the data subject and, to the appropriate extent, conduct proceedings concerning
such complaints.
The list of corrective powers of the supervisory authority is strictly defined in
Article 58(2) GDPR and is binding on the authority. The corrective powers of the
President of the Office include, inter alia, ordering the controller or processor to comply
with the data subject's request arising from his or her rights under this Regulation
(Article 58(2)(c). However, the rights of the data subject are primarily set out in Chapter
III of the GDPR. These include the right to transparent communication with the data
controller (Article 12), the right to information referred to in Articles 13 and 14 of the
GDPR, the right of access (Article 15), the right to rectification (Article 16), erasure
(including the ‘right to be forgotten’) (Article 17), the right to restrict processing (Article
18), the right to object to processing (Article 21), the right to data portability (Article 20).
It should be noted that the Complainant's letter sent to on 5
December 2018 does not constitute a request by the data subject to exercise the
above-mentioned rights under the GDPR. The Complainant’s letter concerns a request
for to take action in order to “affect the management board of its daughter
company’ ’, which will lead to a change in its
current position and the assumption of liability for damage, since by its action described
below it violates the principles of social coexistence and jeopardizes the good name of
the well-known German company .”.
It should be noted that the action that the Complainant expects to take does not
fall within the competence of the President of the Office, who may take only those
actions that are within the scope of its powers and only in those matters that fall within
his competence. In the light of the above, the Complainant’s claim that the President of
13
the Office should order to reply to the Complainant’s letter sent to
on 5 December 2018 cannot be upheld.
In this factual and legal situation, the President of the Office decides as in the
operative part.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the protection of personal
data (Journal of Laws 2019, item 1781) in conjunction with Article 13(2), Article 53(1) and Article 54 of the
Act of 30 August 2002 - Proceedings before Administrative Courts (Journal of Laws 2024, item 935, as
amended), a party dissatisfied with this decision has the right to lodge a complaint with the Voivodship
Administrative Court in Warsaw within 30 days from the date of its delivery to the party. The complaint is
submitted via the President of the Personal Data Protection Office (address: Personal Data Protection
Office, ul. Stawki 2, 00-193 Warsaw). The entry from the complaint is 200 PLN. A party has the right to
apply for exemption from court costs or the right to assistance.
14