TRANSLATION
PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw, 20 May 2025 r.
DS.523.1130.2022.
DECYZJA
Pursuant to Article 105 § 1 the Act of 14 June 1960 Code of Administrative
Procedure (Journal of Laws 2024, item 572) and Article 60(8) of Regulation (EU) 2016/679
of the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Journal of
Laws EU L. of 2016, No 119, p. 1 as amended) with regarding the withdrawal of the
complaint by (residence: )
relating to the irregularities in the processing of his personal data by
(seat: ), the President of the Personal Data Protection Office
discontinues the proceeding.
UZASADNIENIE
The Personal Data Protection Office (hereinafter: the Office) received a complaint of
(residence: ) (hereinafter:
the Complainant) relating to the irregularities in the processing of his personal data by
(seat: ) (hereinafter: the Compnay)
consisting in the processing of personal data without a legal basis and nonfulfillment of the
Complainant’s right to erasure.
The President of the Office identified the case as being of a cross-border nature in
accordance with Article 4(23) of the Regulation (EU) 2016/679 of the European Parliament
and of the Council of 27 April 2016 on the protection of natural persons with regard to the
processing of personal data and on the free movement of such data, and repealing Directive
95/46/EC (General Data Protection Regulation) (Journal of Laws EU L. of 2016, No 119, p.
1 as amended) (hereinafter: GDPR) and on 14.02.2022 via the Internal Market Information
System (hereinafter: IMI) referred the matter to the Swedish supervisory authority (Swedish:
Integritetsskyddsmyndigheten, seat: Fleminggatan 14, plan 7 - Box 8114, 104 20
Stockholm) (hereinafter: IMY), which accepted the case as lead supervisory authority on
22.11.2022.
By letter of 03.03.2025 addressed to the President of the Office, the complainant
withdrew his complaint and asked for this information to be forwarded to IMY.
Urząd Ochrony tel. 22 531-03-46
Danych Osobowych
ul. Stawki 2
00-193 Warszawa www.uodo.gov.pl
On 04.03.2025 President of the Office sent the Complainant’s letter of 03.03.2025 to
IMY, together with a translation into English via the IMI system.
On 05.03.2025 IMY, via IMI 60DD notification 743943.1, submitted a draft decision to
close the case following the withdrawal of the Complainant’s complaint. In the context of the
above-mentioned IMI notification, IMY indicated that the draft decision was adopted in
connection with Article 60(8) GDPR.
On 08.04.2025, the President of the Office sent IMY a letter informing the Company
about the collection of sufficient material to issue an administrative decision. IMY confirmed
on 22 April 2025 that it had forwarded the letter to the Company together with information
on the Complainant’s withdrawal of the complaint. On 22 April 2025, the Company
acknowledged receipt of the above-mentioned letter.
After examining all the evidence gathered in the case, the President of the Office
weighed the following.
After examining all the evidence gathered in the case, the President of the Office
weighed the following.
In accordance with Article 56(1) of the GDPR, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out
by that controller or processor in accordance with the procedure provided in Article 60.
Pursuant to Article 60(3) of the GDPR, the lead supervisory authority shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities
concerned. It shall without delay submit a draft decision to the other supervisory authorities
concerned for their opinion and take due account of their views. . In accordance with Article
60(6) of the GDPR where none of the other supervisory authorities concerned has objected
to the draft decision submitted by the lead supervisory authority within the period referred to
in paragraphs 4 and 5, the lead supervisory authority and the supervisory authorities
concerned shall be deemed to be in agreement with that draft decision and shall be bound
by it.
In accordance with Article 60(7) of the GDPR the lead supervisory authority shall
adopt and notify the decision to the main establishment or single establishment of the
controller or processor, as the case may be and inform the other supervisory authorities
concerned and the Board of the decision in question, including a summary of the relevant
facts and grounds. The supervisory authority with which a complaint has been lodged shall
inform the complainant on the decision. However, pursuant to Article 60(8) of the GDPR, by
derogation from paragraph 7, where a complaint is dismissed or rejected, the supervisory
authority with which the complaint was lodged shall adopt the decision and notify it to the
complainant and shall inform the controller thereof. .
The above-mentioned provisions have been analyzed by the European Data
Protection Board (hereinafter: the EDPB), which states in paragraph 225 of Guidelines
02/2022 on the application of Article 60 GDPR, “Thus, a decision dismissing or rejecting a
complaint (or parts of it) should be construed as a situation where the LSA has found, in
handling the complaint, that there is no cause of action regarding the complainant's claim,
and no action is taken in relation to the controller. In such case, the complaint has to be
dismissed or rejected via the decision adopted by the complaint receiving SA, as the case
may be."
2
EDPB in the above mentioned guidelines further states in point 238 that "The CSA,
when issuing a decision, must give full effect to the draft decision, which is binding on LSA
and other CSAs under Article 60(6) and/or the EDPB binding decision following Article
65(1)(a).”
IMY, acting as lead supervisory authority pursuant to Article 56(1) GDPR, transmitted
on 5 March 2025, pursuant to Article 60(3) GDPR, a draft decision under notification 60DD
number 743943.1. Within this notification, IMY indicated that the draft decision is issued in
connection with Article 60(8) GDPR. The President of the Office accepted the draft decision
and did not express any reasoned and relevant objection to it. Having regard the content of
Article 60(6) GDPR, this means that the President of the Office has agreed with IMY on the
draft decision and is bound by it.
Pursuant to Article 60(8) GDPR, the President of the Office, as the authority with
which the complaint was lodged, is competent to adopt the final decision on the case, notify
it to the Complainant and inform the Company thereof.
Pursuant to Article 105 § 1 of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572) hereinafter: CAP, when the proceedings for any reason
have become devoid of subject in whole or in part, the public administration body issues a
decision to discontinue the proceedings in whole or in part, respectively.
As emphasised in the case-law “/.../ the devoid of subject of the administrative
procedure is the lack of subject matter of the procedure. This subject is a specific case in
which a public administration body is competent and at the same time obliged to decide on
the basis of substantive law on the rights or obligations of an individual entity’ (judgment of
the Voivodeship Administrative Court in Warsaw of 5 October 2017, file ref. VI SA/Wa
1093/17).
The structural elements of the subject matter of an administrative case include the
will of an authorised entity, provided that the legislator links the existence of proceedings
with it. The Office shares the position expressed by the Supreme Administrative Court in its
judgment of 9 March 2012 in case ref. I OSK 394/11, according to which: ‘withdrawal of the
request to initiate administrative proceedings is tantamount to the absence of a request from
an authorised entity to examine a specific administrative case, which means that the subject
matter of the proceedings, as indicated in the request, ceases to exist. In other words, when
the application was withdrawn, one of the necessary elements of the administrative case
(objective) was lost, which obliges the authority to discontinue the proceedings (the so-
called objective necessity to discontinue the proceedings) under Article 105 § 1 of the Code
of Administrative Procedure. The reasons for the withdrawal of the application do not
matter.’
We should share the view expressed in legal literature that: ‘the devoid of subject of
the administrative procedure, as provided for in Article 105 § 1 of the Code of Administrative
Procedure, means that one of the elements of the substantive legal relationship is missing
and, therefore, it is not possible to issue a decision resolving the case by ruling on its merits’
(B. Adamiak, J. Borkowski, Code of Administrative Procedure. Commentary, C.H. Beck,
Warsaw 2006, p. 489). Determination by a public authority of the existence of the condition
referred to in Article 105 § 1 of the Code of Administrative Procedure obliges it, as
emphasised in legal literature, to discontinue the proceedings, as there are no grounds for
resolving the case on the merits if that condition is present, and the continuation of the
3
proceedings in such a case would constitute its defectiveness, having a significant impact
on the outcome of the case.
In the present case, it must be concluded that the condition to discontinue the
proceedings based on the devoid of subject of the proceeding under Article 105 § 1 CAP is
present, as the Complainant has withdrawn his complaint in the letter of 03.03.2025. On the
basis of the confirmation by the Company on 22.04.2025 that the Company has received
from IMY the letter of the President of the Office informing about gathering sufficient
evidence to issue an administrative decision and information that the Complainant has
withdrawn his complaint, it must be concluded that the Company does not oppose to it.
In this factual and legal situation, the President of the Office decides as in the
operative part.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the protection
of personal data (Journal of Laws 2019, item 1781) in conjunction with Article 13(2), Article
53(1) and Article 54 of the Act of 30 August 2002 - Proceedings before Administrative
Courts (Journal of Laws 2024, item 935, as amended), a party dissatisfied with this decision
has the right to lodge a complaint with the Voivodship Administrative Court in Warsaw within
30 days from the date of its delivery to the party. The complaint is submitted via the
President of the Personal Data Protection Office (address: Personal Data Protection Office,
ul. Stawki 2, 00-193 Warsaw). The entry from the complaint is 200 PLN. A party has the
right to apply for exemption from court costs or the right to assistance.
4