PL SA TRANSLATION
PRESIDENT
OF THE PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw, 30.09.2025
DS.523.8325.2021.
DECISION
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June
1960 (consolidated text: Journal of Laws 2024, item 572 as amended) in connection with
Article 7(1) of the Act of 10 May 2018 on the protection of personal data (Journal of Laws
2019, item 1781) and pursuant to Article 60 (6) and (8) of Regulation (EU) 2016/679 of
the European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of
such data, and repealing Directive 95/46/EC, following the administrative proceedings
concerning the complaint of (address: )
concerning infringement of Regulation 2016/679 by (registered office:
) consisting in failure to comply with a request for
erasure of personal data in accordance with Article 17 of Regulation 2016/679, President
of the Personal Data Protection Office
discontinues the proceedings.
UZASADNIENIE
Personal Data Protection Office received a complaint from
(address: ) hereinafter referred to as: Complainant, on
irregularities in the processing of the Complainant's personal data by
(registered office: ) (hereinafter: the Company)
consisting in non-fulfilment of the request for deletion of personal data in accordance with
Article 17 of Regulation (EU) 2016/679 of the European Parliament and of the Council of
27 April 2016 on the protection of natural persons with regard to the processing of
personal data and on the free movement of such data, and repealing Directive 95/46/EC,
hereinafter referred to as: Regulation 2016/679 or GDPR.
In accordance with Article 55(1) of Regulation 2016/679, each supervisory
authority shall be competent for the performance of the tasks assigned to and the
exercise of the powers conferred on it in accordance with this Regulation on the territory
of its own Member State. In accordance with Article 56(1) Regulation 2016/679, without
prejudice to Article 55, the supervisory authority of the main establishment or of the
single establishment of the controller or processor shall be competent to act as lead
supervisory authority for the cross-border processing carried out by that controller or
processor in accordance with the procedure provided in Article 60..
The President of the Personal Data Protection Office, hereinafter also referred to
as: The President of UODO, identified the case as being of a cross-border nature in
accordance with Article 4(23) of Regulation 2016/679 and therefore referred the case to
the French supervisory authority (French: Commission Nationale de l'Informatique et des
PL SA TRANSLATION
Libertés), hereinafter referred to as: CNIL. In view of the fact that the Company’s main
establishment is located in France, the handling of the case at issue, in view of the cross-
border nature of the complaint, fell within the competence of the CNIL, which accepted
the case as lead supervisory authority on 23 September 2022.
During the administrative procedure, the President of the Office for Personal Data
Protection established the following facts:
1. On the Company's website at
the Complainant's personal data in the scope of his name,
surname and address were disclosed. (evidence: Complainant’s letter of 14
September 2021)
2. The Complainant indicates that on 08.04.2021 he sent a request from the e-mail
address to the Company’s e-mail address
to delete his personal data regarding the entry at
as well as to organize the search engines that indexed the entry.
(evidence: the Complainant’s letters of 14 September 2021 and 13 November
2022)
3. CNIL, in its capacity as lead supervisory authority pursuant to Article 56(1) GDPR,
submitted on 05.04.2023 a draft decision, stating the following:
Summary of the complaint
This is a complaint filed with the Urzad Orchrno Danych Osobowych (the Polish Data
Protection Authority) that has been broadcasted in IMI on 14 September 2022 and for
which the Commission Nationale de l’Informatique et des Libertés (CNIL) is the LSA.
(“the Complainant”), alleged that he encountered difficulties when he
exercised his right to the erasure of his personal data processed by ,a
company established in France which would not have answered his request sent from
his personal email address.
The Complainant provided a) 2 screenshots of a google search with his name and
surname resulting in a number of results among which a couple on and
b) a screenshot of the email sent on 8 April 2021, in Polish and English, to
from “ ” with the object “data removal”.
GDPR legal references allegedly infringed
• Lawfulness of the processing (Article 6)
• Right to erasure (Article 17)
Actions taken by the CNIL and the Polish SA
Given the time gone by between the date on which exercised his right to the
deletion of his personal data (8 April 2021) and the date on which the CNIL did receive
his complaint via IMI (14 September 2022), the CNIL carried out verifications on the
2
PL SA TRANSLATION
basis of the complainant’s name and surname before contacting the data controller’s
DPO to check whether his personal data was still available online, with no results.
The CNIL then contacted the DPO of the data controller. After providing him with the
Complainant’s email address used to exercise his right, the DPO confirmed to the CNIL
that a) the technical services at cannot find any trace of
email address on the servers and that therefore they have difficulties
understanding the cause of the complaint and ; b) that in any case it is today certain that
the complainant's personal data is not processed by .
What is more, the 2 screenshots provided by the complainant in his complaint cannot be
regarded as an irrefutable proof that the email he used to exercise his right to the
deletion of his personal data processed by was the one he later on
communicated to the Polish DPA upon request of , as the email from
which the email was sent does not appear on the screenshot but only the name and
surname of the complainant. The CNIL does not either have any proof that
did receive his email.
Proposed draft decision in accordance with Article 60.8 GDPR
Pursuant to Article 60.8 GDPR, “By derogation from paragraph 7, where a complaint is
dismissed or rejected, the supervisory authority with which the complaint was lodged
shall adopt the decision and notify it to the complainant and shall inform the controller
thereof.”
In view of these elements, and in the absence of additional information that could lead us
to question response, no breach committed by was
found regarding this processing and the CNIL cannot investigate further.
Therefore, the CNIL hereby proposes that the Polish Data Protection Authority shall
adopt a decision to dismiss this complaint pursuant to Art. 60(8) GDPR. Itshall notify it to
the complainant and inform the controller thereof.
(evidence: memo of 18.04.2023)
4. On 24 April 2023, the President of the UODO asked the CNIL to amend the draft
decision concerning the name of the Complainant, i.e. the change from ‘ ’ to
‘ ’. As to the remainder, the President of the UODO agreed with the draft CNIL
decision (evidence: memo of 18.04.2023)
5. On 16 May 2023, as part of the notification of 61 VMN No 516735, the CNIL sent
a modified draft decision in which it took into account the President of the UODO’s
comment on the correct spelling of the Complainant’s name (evidence: memo of
26/02/2024)
After getting acquainted with the collected evidence, the President of UODO
considered the following.
3
PL SA TRANSLATION
According to the wording of Article 60(3) of Regulation 2016/679, the lead
supervisory authority shall provide the other supervisory authorities concerned with
relevant information on the case without delay. It shall without delay submit a draft
decision to the other supervisory authorities concerned in order to obtain their opinion
and take due account of their comments. If within the period referred to in paragraph 4
and 5 of Regulation 2016/679, i.e. four weeks respectively in the case of a draft decision
or two weeks in the case of an amended draft decision, no other CSA will object to the
draft decision submitted by the LSA, the LSA and the CSAs are deemed to have agreed
on the draft decision and are bound by it (Article 60(6) of Regulation 2016/679).
The rule is that it is the lead supervisory authority that adopts the decision and
communicates it to the main establishment or single establishment of the controller or
processor, respectively, and informs the other supervisory authorities concerned and the
European Data Protection Board of the decision, together with a summary of the facts
and reasons for the decision, while the supervisory authority with which the complaint
has been lodged informs the complainant of the decision (Article 60(7) of Regulation
2016/679). However, in accordance with Article 60(8) of Regulation 2016/679, by way of
exception to paragraph 7, if the complaint is dismissed or rejected, the supervisory
authority with which the complaint was lodged shall adopt a decision and notify it to the
complainant and inform the controller thereof.
The CNIL, following the proceedings on the transmitted complaint, acting on the
basis of Article 60(3) of Regulation 2016/679, on 5 April 2023, forwarded the draft
decision of 4 April 2023 to the other supervisory authorities concerned, including the
President of UODO, in order to obtain their opinion and take due account of their
comments. Within the four-week period referred to in Art. 4 of Regulation 2016/679, no
other CSA objected to the draft decision submitted by the LSA.
The President of UODO, as the supervisory authority concerned, is therefore
bound by the draft decision of the CNIL of 4 April 2023 pursuant to Article 60(6) of
Regulation 2016/679. In view of the agreement between the lead supervisory authority
and the supervisory authorities concerned that the complaint should be dismissed, in
accordance with Article 60(8) of Regulation 2016/679 The President of UODO, as the
supervisory authority with which the complaint was lodged, shall adopt this decision and
notify it to the Complainant and inform the Company (the controller).
In view of the above, the President of UODO agreed with the decision, the findings
of fact and the legal reasoning provided by the CNIL in its draft decision of 4 April 2023
and adopts them as its own.
The President of the UODO as a public administration body, conducting
proceedings on the basis of the provisions of the Code of Administrative Procedure of 14
June 1960 (Journal of Laws 2024, item 572 as amended) (hereinafter: Kpa), assesses,
on the basis of all the evidence, whether a given circumstance has been proven.
Evidence in the proceedings may include, in particular, documents, witness statements,
expert opinions and inspections (Article 75(1) of Kpa). The public administration body
may consider the facts of the case to be established only on the basis of unequivocal
evidence and may not confine itself in this respect to probabilities, unless the provisions
of the Code of Administrative Procedure provide otherwise. As stated by the Supreme
Administrative Court in its judgment of 9 July 1999 (III SA 5417/98), ‘the authority
conducting the proceedings must seek to establish the substantive truth and, according
4
PL SA TRANSLATION
to its knowledge, experience and internal conviction, assess the probative value of
individual means of evidence, the impact of proving one circumstance on other
circumstances’. In the same judgment, the Supreme Court also held that, in
administrative proceedings, the principle that the burden of proof lies with the person
who derives legal effects from a particular fact also applies.
With regard to the allegation that the Company did not comply with the request for
deletion of the Complainant’s data under Article 17 of the GDPR, it should be noted that
the evidence gathered shows that the Company did not record the request for deletion of
the Complainant’s data of 8 April 2021 and that it did not process the Complainant’s
personal data as at the date of the submitting explanations in the case. According to the
findings of the CNIL, the two screenshots provided by the Complainant in his complaint
cannot be regarded as irrefutable evidence that the email address he used to exercise
his right to erasure of personal data processed by the Company was the address which
he subsequently provided to the President of the UODO at the request of the Company.
The CNIL does not have any evidence that the Company received the Complainant’s
email of 08.04.2021. In the light of these elements and in the absence of any additional
information that could lead the CNIL to challenge the Company’s reply, no infringement
by the Company was found in relation to this processing and the CNIL cannot further
investigate.
In the light of the foregoing, it must be concluded that the proceedings in that
regard are devoid of purpose and must be discontinued on account of the finding of the
CNIL as regards the lack of evidence indicating that the Complainant submitted a
relevant request for the exercise of his right to erasure under Article 17 of the GDPR. In
accordance with Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572), hereinafter Kpa, when the proceedings have become
devoid of purpose for any reason, the administrative authority issues a decision to
discontinue the proceedings. In addition, it should be pointed out that the subject-matter
of the proceedings involves the application by a public authority of the provisions of
substantive administrative law. It is stated in legal literature that ‘the devoid of purpose of
administrative proceedings, as provided for in Article 105(1) of the Code of
Administrative Procedure, means that one of the elements of the substantive legal
relationship is missing and, therefore, it is not possible to adopt a decision dealing with
the case by ruling on the merits. The condition of discontinuation of proceedings may
exist even before the initiation of proceedings, which will be disclosed only in the pending
proceedings, and it may also arise during the proceedings, i.e. in a case already pending
before an administrative authority’ (B. Adamiak, J. Borkowski, Code of Administrative
Procedure. Commentary, C. H. Beck, Warsaw 2005, p. 486).
The determination by a public authority of the existence of the condition referred to
in Article 105(1) of the Code of Administrative Procedure obliges it, as is emphasised in
legal literature and case-law, to discontinue the proceedings, since there are no grounds
for resolving the case on the merits in the event of that condition, and the continuation of
the proceedings in such a case would constitute its defectiveness, having a significant
impact on the outcome of the case. The devoid of purpose of the proceedings may also
be the result of a change in the facts of the case. Such a position of the authority is also
reflected in the case-law of the Supreme Administrative Court, e.g. in the judgment of 27
June 1997 (I SA/Wr 871/96) of the Supreme Administrative Court (Supreme
5
PL SA TRANSLATION
Administrative Court) in Wrocław, in which it was stated that ‘proceedings are devoid of
purpose if the authority clearly finds that there are no legal or factual grounds for
examining the merits of the case’. This means that all the elements of the legal and
factual situation under examination are such that there is no need for proceedings to
clarify all those circumstances in the case.
In this factual and legal situation, the President of the Office for Personal Data
Protection ruled as in the operative part.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the
protection of personal data (Journal of Laws 2019, item 1781) and in conjunction with
Articles 13(2), 53(1) and 54 of the Proceedings before Administrative Courts Act of 30
August 2002 (Journal of Laws 2024, item 935 as amended), from this decision, a party
has the right to lodge a complaint with the Voivodeship Administrative Court in Warsaw,
within 30 days from the date of notification of this decision, through the President of the
Personal Data Protection Office (address: Urząd Ochrony Danych Osobowych, ul.
Stanisława Moniuszki 1A, 00 – 014 Warsaw). The entry for the complaint is 200 zlotys.
The party has the right to claim the right to assistance.
6