PL SA TRANSLATION
PRESIDENT
PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw, 23 September 2025
ZWOS.440.5655.2019.
DECISION
Pursuant to Article 105 § 1 of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572) (hereinafter: Kpa), Article 7(1) of the Act of 10 May
2018 on the protection of personal data (Journal of Laws 2019, item 1781), Art. 5 and
Art. 60(9) of Regulation (EU) 2016/679 of the European Parliament and of the Council
of 27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 95/46/EC
(General Data Protection Regulation) (hereinafter: RODO), concerning the complaint of
(residence: ) (hereinafter:
Complainant) concerning irregularities in the processing of the Complainant's personal
data by (registered Office : )
(hereinafter: The Company) consisting in the processing of personal data in violation of
the principle of transparency by failing to provide in Polish the forms for withdrawal of
consent and objection to data processing, as well as failure to comply with the request
for erasure of data, after the proceedings of Spanish supervisory authority Agencia
Española de Protección de Datos (hereinafter: AEPD) in the scope of the complaint
concerning failure to comply with a request for erasure of data and the adoption by the
AEPD of a final decision pursuant to Art. 60(9) GDPR, President of the Personal Data
Protection Office
1) discontinues proceedings in the scope of the complaint concerning the
Company's violation of the principle of transparency by failing to provide
forms for withdrawal of consent and objection to data processing in Polish.
JUSTIFICATION
Personal Data Protection Office (hereinafter: Office) received the Complainant's
complaint regarding irregularities in the processing of his personal data by the Company
consisting in the processing of personal data in violation of the principle of transparency
by failing to provide forms for withdrawal of consent and objection to data processing in
Polish, as well as failure to comply with the request for erasure of data.
In the scope of the complaint concerning the Company’s failure to comply with
the request for erasure, on 1 August 2022 the President of the Office received the final
decision from the AEPD pursuant to Article 60(9) GDPR. It stems from the decision that
the President of the Office and the AEPD, acting on the basis of Article 60(9) GDPR,
PL SA TRANSLATION
agreed to dismiss part of the complaint regarding the processing of personal data in
violation of the principle of transparency and to take action against the part of the
complaint regarding the Company's failure to comply with the request for erasure of
data. According to the final decision of the AEPD, this authority, acting on the basis of
Art. 58(2)(b) GDPR, issued a reprimand to the Company for failure to comply with the
Complainant's request for erasure of data pursuant to Article 17 of the GDPR, i.e.
infringement of Article 12 of the GDPR.
In the course of the administrative proceedings concerning the complaint in the
scope of the processing of personal data in violation of the principle of transparency by
failing to provide withdrawal of consent forms and objections to the processing of data in
Polish, the President of the Office established the following facts:
1. The complainant pointed out that the Company, as the operator of the
mobile application, does not allow the withdrawal of consent to the processing of
personal data and the objection to the processing of data in Polish, as the
relevant forms are available from the application level in Spanish. (evidence:
Complainant’s letter of 12.11.2019)
2. The President of the Office identified the case as being of a cross-border nature
in accordance with Article 4(23) GDPR and 18.03.2020 through the Internal
Market Information System (hereinafter: IMI) referred the case to the AEPD
(evidence: notification report 61VMN with the number 117249.1 of 18.03.2020)
3. On 18 May 2020, the AEPD notified that it accepted the complaint as the lead
supervisory authority for failure to comply with the request for erasure of the
Complainant’s data, while proposing that the complaint be dismissed in so far as
it related to the availability of forms in Spanish only. (evidence: memo of
01.06.2020)
4. On 1 June 2020, the President of the Office sent the Complainant a letter in
which it asked for evidence (e.g. in the form of screenshots) to confirm the
information referred to by the Complainant in the complaint, according to which
the forms for withdrawing consent to the processing of personal data and
expressing objections to the processing of data were available in the
application only in Spanish. (evidence: letter of the President of the Office of
01.06.2020). The Complainant did not reply to the above-mentioned letter.
5. On 11 August 2020, the President of the Office informed the AEPD that the
Complainant had not replied to the letter of 1 June 2020, therefore an agreement
was reached to dismiss the part of the complaint concerning the processing of
personal data in breach of the principle of transparency by failing to provide
withdrawal forms and objections to data processing in Polish (evidence: e-mail of
11.08.2020)
6. On 1 August 2022, the AEPD adopted its final decision on the complaint
concerning the failure to comply with the request for erasure of the Complainant’s
data. In its final decision of 1 August 2022, the AEPD explained that the proposal
to dismiss part of the complaint in so far as it concerns the processing of
2
PL SA TRANSLATION
personal data in breach of the principle of transparency by not making the forms
for withdrawing consent and objecting to the processing of data available in
Polish, presented by the AEPD on 18 May 2020, resulted from the finding that
the data protection forms were downloaded in the language of the city chosen on
the homepage, so that the forms in Polish were available if the Polish city was
chosen. (evidence: AEPD decision of 01.08.2022)
After examining all the evidence gathered in the case, the President of the Office
weighed the following.
In accordance with Article 56(1) GDPR the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried
out by that controller or processor in accordance with the procedure provided in Article
60. On the basis of Article 60(9) GDPR, where the lead supervisory authority and the
supervisory authorities concerned agree to dismiss or reject parts of a complaint and to
act on other parts of that complaint, a separate decision shall be adopted for each of
those parts of the matter. The lead supervisory authority shall adopt the decision for the
part concerning actions in relation to the controller, shall notify it to the main
establishment or single establishment of the controller or processor on the territory of its
Member State and shall inform the complainant thereof, while the supervisory authority
of the complainant shall adopt the decision for the part concerning dismissal or rejection
of that complaint, and shall notify it to that complainant and shall inform the controller or
processor thereof.
In view of the Complainant’s failure to reply to the letter of the President of the
Office of 1 June 2020, in which the President of the Office asked for evidence (e.g. in
the form of screenshots) to confirm the information referred to by the Complainant in the
complaint, according to which the forms for withdrawing consent to the processing of
personal data and expressing objections to the processing of data were available in the
application only in Spanish, the President of the Office agreed with the AEPD on
11 August 2020 to dismiss part of the complaint in the above-mentioned scope and,
moreover, to take action against the Company as regards the complaint concerning
non-compliance with the request for erasure of data.
The AEPD, acting as lead supervisory authority pursuant to Article 56(1) GDPR,
submitted on 01.08.2022 the final decision, under which, pursuant to Aricle 58(2)(b)
GDPR issued a reprimand to the Company for failure to comply with the Complainant's
request for erasure of data pursuant to Article 17 of the GDPR, i.e. infringement of
Article 12 of the GDPR.
On the basis of Art. 60(9) GDPR President of the Office, as the complainant's
supervisory authority, adopts a decision on the part concerning the dismissal or
rejection of this complaint, notifies it to the complainant and informs the controller or
processor about it.
The President of the Office took steps to clarify the matter. In the light of the
AEPD’s proposal to dismiss part of the complaint in so far as it related to the availability
of the forms only in Spanish, the President of the Office sent a letter to the Complainant
in which he asked for evidence (e.g. in the form of screenshots) to confirm the
3
PL SA TRANSLATION
information referred to by the Complainant in the complaint, according to which the
forms for withdrawing consent to the processing of personal data and expressing
objections to the processing of data were available in the application only in
Spanish. The Complainant did not reply to that letter.
At this point, it should be noted that the President of the Office, as a public
administration body, when conducting proceedings on the basis of the provisions of the
Kpa, assesses, on the basis of all the evidence, whether a given circumstance has been
proven. Evidence in the proceedings may include, in particular, documents, witness
statements, expert opinions and inspections (Article 75 § 1 Kpa).
In accordance with the principle of objective truth, as expressed in Article 7 of the
Kpa, in the course of proceedings, public administration bodies shall uphold the rule of
law and take all necessary steps to clarify the facts accurately and to settle the matter,
having regard to the public interest and the legitimate interest of citizens. This is
ensured in particular by the guarantees contained in the rules governing the gathering
of evidence. As stated by the Supreme Administrative Court in its judgment of 9 July
1999 (file reference III SA 5417/98): "(...) That provision expresses both the principle of
objective truth and the principle of the free assessment of evidence. The authority
conducting the proceedings must seek to establish the substantive truth and, according
to its knowledge, experience and internal conviction, assess the probative value of
individual means of evidence, the impact of proving one circumstance on other
circumstances.’ In the same judgment, the Court held that the principle that the burden
of proof rests on the person who derives legal effects from a particular fact also applies
in administrative proceedings.
In accordance with Article 80 of the Kpa, a public authority assesses, on the basis
of all the evidence, whether a given fact has been proved. A public authority may
consider the facts of the case to be established only on the basis of unequivocal
evidence and may not confine itself in that regard to plausibility.
The President of Office fully shares the position of the Supreme Administrative
Court, which in its judgment of 26 October 1984 (ref. II SA 1205/84, ONSA 1984, No 2,
item 98) has ruled: ‘It follows from Articles 7 and 77 § 1 of Kpa that it is for the authority
conducting the administrative procedure to conduct a comprehensive examination and
examination of all evidence. This does not mean that a party is exempt from complicity
in the fulfilment of that obligation, especially since failure to prove a specific fact may
lead to results unfavourable to the party.’
It is also worth quoting the position of the Supreme Administrative Court
expressed in the judgment of 29 September 2020 in case ref. II OSK 1452/20 (LEX No
3075574): ‘Acquisition of full evidence is undoubtedly an obligation on the part of the
authority, but that obligation is not absolute in the sense that the authority is not obliged
to seek, as it were in place of a party, evidence intended to substantiate circumstances
favourable to that party.’
Agreeing with the above considerations and taking into account the established
circumstances of the case, it should be noted that the evidence gathered in the present
case did not confirm the Complainant’s allegation that the Company did not provide the
forms for withdrawing consent and objecting to data processing in Polish and that the
4
PL SA TRANSLATION
forms were available only in Spanish. It is apparent from the evidence gathered in the
case that, in accordance with the findings of the AEPD, the data protection forms are
downloaded in the language of the city chosen on the main page, with the result that the
forms in Polish are available in the case of the choice of the Polish city.
In view of the above, the proceedings are to be discontinued pursuant to Article
105 § 1 Kpa in view of being devoid of purpose. According to the above-mentioned
provision, when proceedings have become devoid of purpose in whole or in part for any
reason, the public administration authority shall issue a decision to discontinue the
proceedings in whole or in part, respectively. The wording of that provision leaves no
doubt that, if the proceedings are found to be devoid of purpose, the authority
conducting those proceedings is obliged to discontinue them. At the same time, the
subject-matter literature indicates that the devoid of purpose of the administrative
procedure, as provided for in Article 105 § 1 of Kpa, means that one of the elements of
the substantive legal relationship is missing, and therefore a decision dealing with the
case cannot be issued by ruling on its substance. The condition of discontinuation of
proceedings may exist even before the initiation of proceedings, which will be revealed
only in the ongoing proceedings, and it may also arise during the proceedings, i.e. in a
case already pending before a public administration body (comment to the article in
question in the Code of Administrative Procedure: Adamiak, B. and Borkowski, J., ‘Code
of Administrative Procedure. Commentary’, 17th edition, Legalis C.H. Beck, Warsaw
2021). This position is also reflected in the case-law (judgment of the Provincial
Administrative Court in Gliwice of 22 December 2021, ref. I SA/Gl 1165/21; judgment of
the Provincial Administrative Court in Lublin of 7 December 2021, III SA/Lu 526/21;
judgment of the Provincial Administrative Court in Poznań of 17 September 2021, II
SA/Po 688/20).
The determination by a public authority of the existence of the condition referred
to in Article 105 § 1 of Kpa obliges it, as is emphasised in legal literature and case-law,
to discontinue the proceedings, since there are no grounds for resolving the case on the
merits, and the continuation of the proceedings in such a case would constitute its
defectiveness, having a significant impact on the outcome of the case.
In those factual and legal circumstances, the President of the Office ruled as in
the operative part.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
5
PL SA TRANSLATION
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the
protection of personal data (Journal of Laws 2019, item 1781) and in conjunction with
Articles 13 § 2, 53 § 1 and 54 of the Proceedings before Administrative Courts Act of 30
August 2002 (Journal of Laws 2024, item 935 as amended)., from this decision, a party
has the right to lodge a complaint with the Provincial Administrative Court in Warsaw,
within 30 days from the date of notification of this decision, through the President of the
Personal Data Protection Office (address: Personal Data Protection Office, ul.
Stanisława Moniuszki 1A, 00 – 014 Warsaw). The entry for the complaint is 200 zlotys.
The party has the right to claim the right to assistance.
6