PRESIDENT
PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw , … 2025 r.
DS.523.5159.2021.
DECISION
Pursuant to Article 104 § 1 and Article 105 § 1 of the Act of June 14, 1960, Code of
Administrative Procedure (Journal of Laws of 2024, item 572), Articles 7 and 60(8) of
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on
the free movement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation) (OJ EU L 2016 No. 119, p. 1, as amended) (hereinafter: GDPR),
after conducting administrative proceedings concerning the complaint of
(address: ) concerning the violation of Article 7
of the GDPR by (registered office:
), the President of the Personal Data Protection Office
1) dismisses the administrative proceedings concerning the Company's
violation of Article 7 of the GDPR;
2) rejects the request in all other respects.
JUSTIFICATION
The Personal Data Protection Office received a complaint from
(address: ) (hereinafter: the Complainant) concerning
the processing of his personal data by (registered office:
) (hereinafter: the Company). In the
complaint, the Complainant indicated that the Company processes his personal data in
violation of Article 7 of the GDPR and recitals 32, 33, 42, 43, and 58 of the GDPR by not
providing a real, easy, and effective possibility to withdraw consent to data processing.
In the complaint, the Complainant indicated that he is the recipient of marketing
correspondence in the form of newsletters received from the Company, containing a link
described as “Unsubscribe,” which in practice does not lead to the effective withdrawal of
consent. Despite repeated attempts to use this link, documented by screenshots attached
to the complaint, as well as direct contact with the Company, the subscription has not been
canceled.
Personal Data tel. 22 531-09-88
Protection Office
Stanisława Moniuszki 1A street
www.uodo.gov.pl
00-014 Warsaw
The complainant pointed out that the content published on the website and in email
correspondence disseminates false information about the conditions for withdrawing
consent, which is not reflected in the actual operation of the website, misleading users and
violating the standards set out in Article 7 of the GDPR and the EDPB's recitals and
guidelines on voluntariness, informed consent, unambiguity, and the possibility of easy
withdrawal of consent.
In connection with the above, the Complainant requested the President of the
Personal Data Protection Office (hereinafter: President of the PDPO) to verify the legality
of the Company's actions and to impose corrective measures consisting of: ordering the
removal of the Complainant's personal data processed without a legal basis; obliging the
controller to fulfill its full information obligation towards all users, including ceasing to
reproduce false information regarding the withdrawal of consent and sending a separate e-
mail to all active subscribers clearly titled, containing reliable explanations of the
shortcomings preventing the cancellation of subscriptions and the deletion of data, without
including any commercial content. The complainant also requested that the data controller
and the persons to whom he reported the violations be held accountable for failing to take
corrective action and downplaying the matter, as well as the persons responsible for the
operation of the IT system supporting the newsletter, whose actions misled users as to the
real possibility of withdrawing their consent referred to in Article 7 of the GDPR. In
addition, the complainant demands that a financial penalty be imposed on the company for
gross violations or deliberate disregard of the provisions of the GDPR in order to gain an
advantage through unlawful data processing, and that the complainant be informed of the
outcome of the proceedings.
In the course of the administrative proceedings, the President of the PDPO
established the following facts:
1) On July 28, 2021, the Complainant emailed the Company from the e-mail
address with a request to delete his account from the servers
of “ ” The Company replied to the Complainant on July 29,
2021, indicating that his account had been deleted and his subscription to the
Company's newsletter had been deactivated. The Company stipulated that the
Complainant may receive newsletters for 48 hours after receiving the message.
(evidence: the Complainant's letter of August 13, 2021)
2) The Complainant received newsletters from the Company after 48 hours have
passed from July 29, 2021, i.e., at least on August 5 and 12, 2021 (evidence: the
Complainant's letter of August 13, 2021).
3) On August 20, 2021, the President of the PDPO identified the case as cross-
border in nature pursuant to Article 4(23) of the GDPR. Therefore, on August 26,
2021, the case was referred via the Internal Market Information System
(hereinafter: IMI) to the Berlin supervisory authority (Landesbeauftragter für
Datenschutz und Informationsfreiheit Berlin) (hereinafter: Berlin SA) for the
purpose of taking over the case as the lead supervisory authority within the
2
meaning of Article 56(1) of the GDPR. (evidence: official note of August 20,
2021; letter from the President of the PDPO of August 26, 2021).
4) On November 22, 2021, Berlin SA created a notification in the IMI system under
Article 61 – mutual assistance, number 342198.1, in which, as the lead
supervisory authority, it asked the President of the PDPO to provide by the
Complainant with more detailed information on the facts of the case, in
particular: confirmation that Appendix 3 indicated in the complaint presents
newsletters received after the withdrawal of consent (from July 29, 2021),
provision of the full content of all e-mails from the Company received in the
period from July 28, 2021, indication of specific false information on the website
and in correspondence (including the unsubscribe link and clarification of
whether, in the email of July 28, 2021, the Complainant requested only the
withdrawal of the newsletter subscription or also the deletion of the customer
account. (evidence: letter from the President of the PDPO of December 6, 2021)
5) On March 15, 2022, the President of the PDPO again requested the
Complainant to provide additional explanations, due to the Complainant's failure
to respond to the letter of November 22, 2021, calling for the submission of the
requested information and materials. (evidence: letter from the President of the
PDPO dated March 15, 2022)
6) On August 22, 2022, the Company provided Berlin SA with explanations
indicating that the Complainant had created a second customer account on the
website using the mechanism. The Company
indicated that under this registration mode, the user is redirected to the
website for authentication and then has the option to choose whether to disclose
their actual email address associated with their to or
to use the option to hide it. If the user chooses to hide their email address,
generates an individual, encrypted email address identifier, which is used to
create and store the customer account on . Thus,
does not have the user's “actual” email address. At the same time, all
electronic correspondence is delivered to the user at their actual email address
through automatic redirection on 's side. The company pointed out that the
identifier assigned to the complainant, generated by , i.e.,
, is reflected in the newsletter attached as
Appendix 5 to the complaint. (evidence: memo dated March 8, 2024, with
attachments)
7) The Company informed Berlin SA that the customer's second account, created
using an , remains active, and that on September 28, 2021, the
Complainant was to unsubscribe from the newsletter assigned to that account.
At the same time, according to the Company, the Complainant has not yet
requested the deletion of the second account in question. (evidence: memo
dated March 8, 2024, with attachments)
3
8) On September 25, 2023, Berlin SA submitted a draft decision notification A60DD
with a reference number 558611.1 to the President of the PDPO via IMI, the
content of which is summarized below:
Berlin SA states that, based on the Company's explanations of June 23, 2022, August 22,
2022, and November 11, 2022, it was unable to identify any violation of the GDPR by
.
In its draft decision, Berlin SA presented the facts of the case as follows:
1. The complainant stated that he attempted to unsubscribe from the Company's
newsletter using the “Unsubscribe” button at the end of the newsletter, but the
unsubscribe button did not work. The complainant then requested the deletion of his
customer account by email on July 28, 2021. Customer service confirmed
the deletion of the customer account by email on July 29, 2021. and informed the
Complainant that he had been unsubscribed from the newsletter, but that for
technical reasons, it could take up to 48 hours for the unsubscription to take effect.
The Complainant stated that he continued to receive newsletters from the Company
after 48 hours had elapsed, at least on August 5 and 12, 2021.
2. In a letter dated June 23, 2022, the Company informed Berlin SA that the customer
account created using the Complainant's email address could no longer be found in
the database and that, therefore, the facts of the case could no longer be fully
identified by the Company. However, it is assumed that the deletion was initiated
and finally carried out on July 29, 2021. With regard to the Complainant's claim that
the unsubscribe link did not work, the Company informed Berlin SA that technical
errors cannot be ruled out in individual cases. However, the description of the facts
presented by the Complainant was not sufficient to identify a possible cause as a
technical error.
3. Berlin SA pointed out that, in response to the inquiry, the Company stated in a letter
dated August 22, 2022, that the newsletter sent to the Complainant in August 2021
was due to the fact that the Complainant had created a second customer account
using his . In this regard, the controller stated that when registering with
, there is an option to register “using .” When a customer selects the
“sign in with ” option, they are redirected to a landing page where they must
enter their . Customers can then choose whether the email address they
registered with should be shared with the Company or hidden (the “Hide-my-
email” function). If the person decides that the email address should be hidden from
the Company, generates an encrypted and individually coded email address
to open the customer's account, which will be stored by the Company. The real
email address, masked by encryption, will remain unknown to the
Company. Due to the automatic forwarding set up by , all emails will be
forwarded to the real email address stored with .
4. Berlin SA also pointed out that the Complainant received the aforementioned
newsletters because he created a second customer account “using ” in
addition to his originally created customer account and used the “Hide my email”
4
function, and then in turn registered the same email address with as on the
Company's first customer account. The Complainant's second customer account,
which was created using the “Sign in with ” login function, is still active
because the Complainant has not requested its deletion. Consent for this customer
account was granted on April 19, 2021. In this regard, the Company sent Berlin SA
a screenshot of its system (in a letter dated November 16, 2022). The complainant
also unsubscribed from the newsletter for this customer account on September 28,
2021. Berlin SA further pointed out that the Company had stated that in future,
potential customers would be informed about the specifics of using “Hide-
my-e-mail” feature.
5. Berlin SA indicated that it had notified the President of the PDPO of the situation on
October 10, 2022, and requested that the Complainant be informed and that the
German authority be notified of any possible different or additional comments from
the Complainant.
Furthermore, Berlin SA presented a legal assessment of the current facts of the case in
the draft decision, while being unable to find a violation of the GDPR by the Company,
justifying this as follows:
1. Berlin SA pointed out that the Complainant disputed the fact that he continued to
receive newsletters from the Company at his email address even after receiving
confirmation that his customer account had been deleted. This concerns
newsletters received after July 29, 2021, including at least the newsletters of August
5 and 12, 2021. The sending of newsletters on August 5 and 12, 2021, could be
based on consent in accordance with Article 6(1)(a) in conjunction with Article 7 of
the GDPR. According to the Company's statements, consent was given on April 19,
2021, and had not been revoked at the time of sending the newsletters on August 5
and 12, 2021. Berlin SA also indicated that it had not received any conflicting
information in this regard.
2. Berlin SA pointed out that, as demonstrated in the course of the complaint
proceedings, the Complainant created two customer accounts with , one
with an email address and the other via the “sign in with ” function with an
email address. In the case of the second customer account, the Complainant
agreed to receive the newsletter on April 19, 2021. The aforementioned newsletters
were sent by the Company to the email address and then, thanks to “Hide-
my-email” function, were automatically forwarded to the email address, without the
Company's knowledge.
3. Berlin SA pointed out that the Complainant submitted a request for data deletion on
July 28, 2021. Since the Complainant did not inform customer service about the
existence of a second customer account, customer service understandably
assigned the request for data deletion exclusively to the first customer account from
which the request for data deletion was submitted. During the deletion process, the
newsletter sent to the Complainant's email address was consequently stopped.
5
4. Furthermore, Berlin SA pointed out that since no mention was made of the request
to delete the second customer account containing the email address in the email
sent by the Complainant on July 28, 2021, consent was not initially revoked in this
regard either. At the time when the newsletters were sent to the email address on
August 5 and 12, 2021, the consent, and thus the legal basis for data processing,
still existed. According to the Company's statements, the consent was not revoked
by the Complainant until September 28, 2021.
5. Berlin SA also pointed out that the fact that further advertising emails were sent to
the Complainant after he withdrew his consent on September 28, 2021, was not
confirmed by the Complainant and is not apparent from the attachments submitted
by the Complainant.
6. Berlin SA explained, with regard to the “Unsubscribe” button, that it was unable to
prove any violation by the Company. The complainant did not explain when and for
which email he attempted to unsubscribe from the newsletter using the
“Unsubscribe” button. The above statements may also provide a possible
explanation for the fact that the Complainant continued to receive newsletters after
unsubscribing using the “Unsubscribe” button, if he unsubscribed only for the email
address [complainant's email address has been removed]. Berlin SA assessed that
there had been no violation of personal data protection regulations, and the
complaint proceedings were resolved to the satisfaction of the Complainant, and the
case was closed.
(evidence: memo dated October 18, 2023)
After reviewing all the evidence gathered in the case, the President of the PDPO
considered the following.
In accordance with Article 56(1) of the GDPR, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out
by that controller or processor in accordance with the procedure provided in Article 60.
Pursuant to Article 60(3) of the GDPR, the lead supervisory authority shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities
concerned. It shall without delay submit a draft decision to the other supervisory authorities
concerned for their opinion and take due account of their views. . In accordance with
Article 60(6) of the GDPR where none of the other supervisory authorities concerned has
objected to the draft decision submitted by the lead supervisory authority within the period
referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory
authorities concerned shall be deemed to be in agreement with that draft decision and
shall be bound by it.
In accordance with Article 60(7) of the GDPR the lead supervisory authority shall
adopt and notify the decision to the main establishment or single establishment of the
controller or processor, as the case may be and inform the other supervisory authorities
concerned and the Board of the decision in question, including a summary of the relevant
6
facts and grounds. The supervisory authority with which a complaint has been lodged shall
inform the complainant on the decision. However, pursuant to Article 60(8) of the GDPR,
by derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof. .
The above-mentioned provisions have been analyzed by the European Data
Protection Board (hereinafter: the EDPB), which states in paragraph 225 of Guidelines
02/2022 on the application of Article 60 GDPR, “Thus, a decision dismissing or rejecting a
complaint (or parts of it) should be construed as a situation where the LSA has found, in
handling the complaint, that there is no cause of action regarding the complainant's claim,
and no action is taken in relation to the controller. In such case, the complaint has to be
dismissed or rejected via the decision adopted by the complaint receiving SA, as the case
may be."
EDPB in the above mentioned guidelines further states in point 238 that "The CSA,
when issuing a decision, must give full effect to the draft decision, which is binding on LSA
and other CSAs under Article 60(6) and/or the EDPB binding decision following Article
65(1)(a).”
Berlin SA, acting as the lead supervisory authority pursuant to Article 56(1) of the
GDPR, submitted a draft decision pursuant to Article 60(3) of the GDPR, in which it
indicated that the draft decision was issued in accordance with Article 60(8) of the GDPR.
The President of the Personal Data Protection Office did not raise any relevant and
reasoned objections. In view of the content of Article 60(6) of the GDPR, this means that
the President of the PDPO has agreed with Berlin SA on the draft decision and is bound
by it.
Pursuant to Article 60(8) of the GDPR, the President of the PDPO, as the authority
to which the complaint was lodged, is competent to adopt a final decision on the matter,
deliver it to the complainant, and inform the controller thereof.
The President of the PDPO, as a public administration body, conducting
proceedings based on the provisions of the Act of June 14, 1960, Code of Administrative
Procedure (Journal of Laws of 2024, item 572, consolidated text), hereinafter referred to
as CAP, assesses on the basis of all the evidence whether a given circumstance has been
proven. Evidence in the proceedings may include, in particular, documents, witness
statements, expert opinions, and visual inspections (Article 75 § 1 CAP).
Pursuant to Article 80 of CAP, a public administration body assesses, on the basis
of all the evidence, whether a given circumstance has been proven. A public
administration body may consider the facts of the case under consideration to be
established only on the basis of evidence that is beyond doubt and may not rely on mere
probability in this respect. As stated by the Supreme Administrative Court in its judgment
of July 9, 1999 (ref. no. III SA 5417/98), quote: "(...) This provision expresses both the
principle of objective truth and the principle of free evaluation of evidence. The authority
conducting the proceedings must strive to establish the material truth and, according to its
knowledge, experience, and internal conviction, assess the evidential value of individual
7
pieces of evidence and the impact of proving one circumstance on other circumstances."
The court also stated that in administrative proceedings, the principle applies that the
burden of proof rests with the party who derives legal consequences from a specific fact.
The President of the PDPO shares the position of the Supreme Administrative Court
expressed in its judgment of October 26, 1984 (ref. no. II SA 1205/84, ONSA 1984, No. 2,
item 98), which ruled: “It follows from Articles 7 and 77 § 1 of the Code of Administrative
Procedure that the obligation to thoroughly examine and consider all evidence rests with
the authority conducting the administrative proceedings. This does not mean that the party
is exempt from participating in the fulfillment of this obligation, especially since failure to
prove a specific factual circumstance may lead to results that are unfavorable to the party.”
After exhausting all possibilities for making the factual findings necessary to reach a
decision, the authority conducting the proceedings is entitled, and even obliged, to accept
the version of events that is logically consistent with the remaining evidence. It is also
worth quoting the position of the Supreme Administrative Court expressed in its judgment
of September 29, 2020, in case no. II OSK 1452/20 (LEX No. 3075574) (quote):
“Gathering all the evidence is undoubtedly the duty of the authority, but this duty is not
absolute in the sense that the authority is not obliged to search, as it were, on behalf of a
party, for evidence to confirm circumstances favorable to that party.”
With regard to the Complainant's allegation of a violation of Article 7 of the GDPR in
light of recitals 32, 33, 42, 43, and 58 of the GDPR and the EDPB Guidelines on consent,
consisting in the processing of data for marketing purposes despite the Complainant's use
of the “Unsubscribe” button and the request to delete the account dated July 28, 2021, it
should be noted that, in accordance with Article 7(1) of the GDPR, if processing is based
on consent, the controller must be able to demonstrate that the data subject has
consented to the processing of their personal data. Pursuant to Article 7(3) of the GDPR,
the data subject has the right to withdraw consent at any time. The withdrawal of consent
shall not affect the lawfulness of processing based on consent before its withdrawal. The
data subject shall be informed of this before giving consent. Withdrawal of consent must
be as easy as giving consent.
The evidence gathered does not clearly indicate that the Company engaged in
practices that prevented or unduly hindered the withdrawal of consent to data processing.
In the present case, it has been established that on July 28, 2021, the Complainant
requested the Company to delete his customer account, which was confirmed by the
Company on July 29, 2021, together with information about the deactivation of the
newsletter subscription. Despite this, the Complainant received marketing messages 48
hours after the confirmation of the account deletion. The reason for sending newsletters
after that date was the existence of a second customer account, created by the
Complainant using the “Sign in with ” mechanism with the “Hide my email” function.
This account remained active. Consent to receive the newsletter for the second customer
account was given on April 19, 2021, and was not withdrawn until September 28, 2021,
when the Complainant unsubscribed from the subscription assigned to the second
account. It has also not been demonstrated that, after the consent was withdrawn on
September 28, 2021, further marketing messages were sent to the Complainant.
8
The available evidence also does not allow for confirmation of the allegation
concerning the ineffectiveness of the “Unsubscribe” mechanism. The complainant did not
provide information allowing for an unambiguous determination of when and in relation to
which email address he attempted to use this function. In light of the evidence gathered,
there are no grounds for finding that the Company has violated Article 7 of the GDPR in
this regard.
In this situation, the present proceedings pursuant to Article 105 § 1 of CAP, shall
be discontinued in the above-mentioned scope, as they have become devoid of purpose.
Pursuant to the above provision, if, for any reason, the proceedings have become devoid
of purpose in whole or in part, the public administration body shall issue a decision to
discontinue the proceedings in whole or in part, respectively. The wording of the
aforementioned regulation leaves no doubt that if the proceedings are found to be devoid
of purpose, the authority conducting the proceedings is obliged to discontinue them. At the
same time, the literature on the subject indicates that the devoid of purpose of
administrative proceedings, as provided for in Article 105 § 1 of CAP, means that one of
the elements of the substantive legal relationship is missing, and therefore it is not
possible to issue a decision resolving the case by deciding on its merits (B. Adamiak, J.
Borkowski, “Administrative Procedure Code. Commentary,” 7th edition, C.H. Beck
Publishing House, Warsaw 2005, p. 485). The same position was taken by the Provincial
Administrative Court in Krakow in its judgment of February 27, 2008 (III SA/Kr 762/2007):
“Proceedings become devoid of purpose when one of the elements of the substantive
legal relationship is missing, which means that the case cannot be resolved by a decision
on the merits.”
The determination by a public authority of the existence of the condition referred to
in Article 105 § 1 of CAP obliges it, as emphasized in doctrine and jurisprudence, to
discontinue the proceedings, as there are then no grounds for deciding the case on its
merits, and continuing the proceedings in such a case would constitute a defect that would
have a significant impact on the outcome of the case.
The Complainant also requested that the Company be ordered to delete the
complainant's personal data processed without legal basis; to fulfill its obligation to inform
all users of the website about irregularities in data processing, and to hold the
Company and its employees accountable for failing to take corrective action, downplaying
the situation, and misleading users by not allowing them to withdraw their consent to the
processing of personal data.
In this regard, it should be noted that the assessment made by the President of the
PDPO in each case serves to examine the legitimacy of addressing a decision to a specific
entity in accordance with Article 58(2) of the GDPR, which serves to apply the corrective
powers specified in that provision, provided that irregularities in the processing of personal
data have occurred.
On the basis of the investigation carried out by the Berlin SA and the adopted draft
decision, in the opinion of the President of the PDPO, there are no grounds for concluding
that irregularities occurred in this case, as the processing of the Complainant's personal
9
data by the Company was carried out in accordance with the law, and therefore it is
justified for the President of the PDPO to issue a decision refusing to grant the
Complainant's requests in this regard.
In view of the facts and legal circumstances, the President of the PDPO ruled as
stated in the operative part.
It should be noted that the President of the PDPO may impose an administrative
fine on the controller (Article 58(2)(i) of the GDPR), but does so ex officio, not at the
request of the complainant.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
The decision is final. Pursuant to Article 7(2) of the Act of May 10, 2018, on the
protection of personal data (Journal of Laws of 2019, item 1781) and in connection with
Article 13 § 2, Article 53 § 1, and Article 54 of the Act of August 30, 2002, on proceedings
before administrative courts (Journal of Laws of 2024, item 935), the party has the right to
lodge a complaint with the Provincial Administrative Court in Warsaw within 30 days of the
date of delivery of this decision, through the President of the Personal Data Protection
Office (address: Personal Data Protection Office, Stanisława Moniuszki 1A street, 00-014
Warsaw). The fee for filing a complaint is PLN 200. The party has the right to apply for
legal aid, including exemption from court costs.
10