TRANSLATION
PRESIDENT
PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw, 31.12.2025
DS.523.1602.2023.
DECISION
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572) and Article 60(8) of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter:
GDPR), after conducting an administrative procedure regarding the complaint of
(residence: ) concerning irregularities in the
processing of personal data by (registered office:
), President of the Personal Data Protection Office
discontinues the proceedings.
JUSTIFICATION
The Personal Data Protection Office received a complaint from
(residence: ) (hereinafter: Complainant) concerning
infringement of the processing of his personal data by (registered office:
) (hereinafter: The Company) consisting in the
refusal to delete the Complainant's personal data. In the complaint, the Complainant
indicated that it was not possible to delete his data after the Company blocked the
account. The Complainant then wrote to the Company to delete his data, but the Company
refused to grant his request.
In view of the above, the Complainant requested the President of Personal Data
Protection Office (hereinafter: PUODO) intervention in helping to delete his data on the
Company's website.
In the course of the administrative proceedings, the PUODO established the
following facts:
1) On 8 March 2023, the Complainant lodged a complaint with the PUODO, in
which he forwarded his previous correspondence with the Company, which
refused to delete his personal data. (evidence: Complainant’s letter of
08/03/2021)
Personal Data tel. 22 531-09-88
Protection Office
ul. Stanisława Moniuszki 1A
www.uodo.gov.pl
00-014 Warsaw
TRANSLATION
2) On 4 April 2023, the PUODO identified the case as having a cross-border nature
in accordance with Article 4(23) of the GDPR. Accordingly, on 4 April 2023, the
case was referred in notification No 61 VMN 503169.1 via the Internal Market
Information System (hereinafter: IMI) to the State Data Protection Inspectorate
of the Republic of Lithuania (hereinafter: Lithuania SA) in order to accept the
case to be handled by this body as a leading supervisory authority within the
meaning of Article 56(1) GDPR. (evidence: memo of 04.04.2023)
3) 26.04.2023 Lithuania SA agreed to accept the case as lead supervisory
authority and in the notification number 61 VMN 354425.1 (evidence: letter from
the PUODO of 26 April 2023)
4) 22.07.2025 Lithuania SA submitted a letter informing that in accordance with
Article 29(1)(4) of the Law on the Legal Protection of Personal Data of the
Republic of Lithuania (hereinafter ‘LLPPD‘) provides that the supervisory
authority shall adopt a decision to terminate the examination of a complaint or
part thereof if it is established that it is not possible to examine the complaint or
part thereof due to a lack of information or other significant circumstances.
5) Lithuania SA informed that, by Decision No. 3R-703 (2.13-1.E) of 2 July 2024,
the Company was fined EUR 2,385,276 for infringements concerning the
improper implementation of Article 5(1)(a) of the GDPR (principles of
transparency and fairness) and Article 12(1) and (4) of the GDPR, due to the
provision of inadequate responses to data subjects' requests relating to the right
to erasure. It should be emphasized, however, that no infringement of Article 17
of the GDPR was established. In view of the above, Lithuania SA requested that
the Complainant responds to this letter no later than to this letter by no later than
14 days after service of this letter at the latest, indicating whether they wish to
pursue further examination of your complaint. Lithuania SA informed that if no
response is received by the specified date, or if the Complainant confirms that
further examination of the complaint is no longer relevant, the Inspectorate will
treat this as a relevant circumstance constituting grounds for terminating the
examination of the complaint pursuant to Article 29(1)(4) of the LLPPD.
(evidence: letter from the PUODO of 22.07.2025)
6) In the absence of a reply from the Complainant within the deadline, Lithuania
SA, via the IMI System, sent the President of the DPO a draft decision on 14
November 2025 in notification A60DD 848302.1, the content of which is
presented below:
Lithuania SA found that, In his Complaint, the Applicant stated that his
account had been blocked, which led him to contact the Company to request the deletion
of the account. According to the Applicant, the response he received was unsatisfactory.
Lithuania SA, being competent to act as the lead supervisory authority and to
submit draft decision on the Complaint of the Applicant (Articles 56 and 60(3) of
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016
on the protection of natural persons with regard to the processing of personal data and on
2
TRANSLATION
the free movement of such data, and repealing Directive 95/46/EC (General Data
Protection Regulation ("GDPR”)) has determined that on 5 and 6 February 2024, the
Inspectorate, in cooperation with the supervisory authorities of Germany, the Netherlands,
Spain, Poland and France, adopted 54 final decisions concerning the infringements by the
Company of Article 5(1)(a) of the GDPR (principles of fairness and transparency) and
Articles 12(1) and 12(4) of the GDPR in the context of responding to data subjects'
requests for the right to be forgotten (Article 17 of the GDPR). For the infringements found,
the Inspectorate imposed an administrative fine of EUR 2 385 276 on the Company by
Decision No 3R-702 (2.13-1.E) of 2 July 2024.
Considering that the subject matter of the Applicant’s Complaint coincided with the
infringements identified on 5 and 6 February 2024 and that on 2 July 2024 an
administrative fine was imposed on the Company, the Inspectorate contacted the Polish
supervisory authority on the basis of the mutual assistance procedure and requested them
to contact the Applicant on the relevance of further examination of the Complaint (Article
61(1) of the GDPR).
On 11 September 2025, the Polish supervisory authority informed the Inspectorate
that, after contacting the Applicant and giving him a time limit of 14 days to respond on the
relevance of the Complaint, the Applicant did not respond within the set time limit.
Article 29(1)(4) of the Republic of Lithuania Law on Legal Protection of Personal
Data (“LLPPD”) provides that the supervisory authority shall take a decision to terminate
the examination of a complaint or part thereof if, during the examination of a complaint or
part thereof, it becomes evident that the complaint or part thereof cannot be considered
due to lack of information or other significant circumstances.
In view of the fact that the Applicant did not submit a reply to the letter of the Polish
supervisory authority on the relevance of the Complaint, as well as the fact that the subject
matter of the Complaint coincided with the infringements found on 5 and 6 February 2024,
and the fact that the Company was subject to an administrative fine of EUR 2 385 276 on
2 July 2024 for these infringements, the Inspectorate considers these circumstances to be
significant circumstances which constitute grounds for the termination of the examination
of the Complaint under Article 29(1)(4) of the LLPPD.
In accordance with the above, as well as with Article 29(1)(4) of the LLPPD and
Articles 60(3) and 60(8) of the GDPR, Lithuania SA decides to terminate the examination
of the Applicant’s Complaint.
(evidence: memo of 18.11.2025)
After examining all the evidence gathered in the case, the PUODO weighed the
following.
In accordance with Article 56(1) of the GDPR, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out
3
TRANSLATION
by that controller or processor in accordance with the procedure provided in Article 60.
Pursuant to Article 60(3) of the GDPR, the lead supervisory authority shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities
concerned. It shall without delay submit a draft decision to the other supervisory authorities
concerned for their opinion and take due account of their views. In accordance with Article
60(6) of the GDPR where none of the other supervisory authorities concerned has
objected to the draft decision submitted by the lead supervisory authority within the period
referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory
authorities concerned shall be deemed to be in agreement with that draft decision and
shall be bound by it.
In accordance with Article 60(7) of the GDPR the lead supervisory authority shall
adopt and notify the decision to the main establishment or single establishment of the
controller or processor, as the case may be and inform the other supervisory authorities
concerned and the Board of the decision in question, including a summary of the relevant
facts and grounds. The supervisory authority with which a complaint has been lodged shall
inform the complainant on the decision. However, pursuant to Article 60(8) of the GDPR,
by derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof.
The above-mentioned provisions have been analyzed by the European Data
Protection Board (hereinafter: the EDPB), which states in paragraph 225 of Guidelines
02/2022 on the application of Article 60 GDPR, “Thus, a decision dismissing or rejecting a
complaint (or parts of it) should be construed as a situation where the LSA has found, in
handling the complaint, that there is no cause of action regarding the complainant's claim,
and no action is taken in relation to the controller. In such case, the complaint has to be
dismissed or rejected via the decision adopted by the complaint receiving SA, as the case
may be."
EDPB in the above mentioned guidelines further states in point 238 that "The CSA,
when issuing a decision, must give full effect to the draft decision, which is binding on LSA
and other CSAs under Article 60(6) and/or the EDPB binding decision following Article
65(1)(a).”
Lithuania SA, acting as lead supervisory authority pursuant to Article 56(1) GDPR,
transmitted on 9 April 2024, pursuant to Article 60(3) GDPR, a draft decision under
notification 60DD number 626110.1. Within this notification, Lithuania SA indicated that the
draft decision is issued in accordance with Article 60(8) GDPR. The PUODO accepted the
draft decision and did not express any reasoned and relevant objection to it. Having regard
to the content of Article 60(6) GDPR, this means that the PUODO has agreed with the
Lithuania SA on the draft decision and is bound by it.
Pursuant to Article 60(8) GDPR, the PUODO, as the authority with which the
complaint was lodged, is competent to adopt the final decision on the case, notify it to the
Complainant and inform the controller thereof.
4
TRANSLATION
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572) (hereinafter: CAP) , the administrative procedure is
discontinued when it is devoid of purpose. Under that provision, where proceedings have
become devoid of purpose in whole or in part for any reason, the public authority is to
issue a decision to discontinue the proceedings in whole or in part, as appropriate. The
wording of that provision leaves no doubt that, if the proceedings are found to be devoid of
purpose, the authority conducting those proceedings is obliged to discontinue them. At the
same time, the subject-matter literature indicates that the devoid of purpose of the
administrative procedure, as provided for in Article 105(1) of the Code of Administrative
Procedure, means that one of the elements of the substantive legal relationship is missing,
and therefore it is not possible to issue a decision settling the case by ruling on its merits
(B. Adamiak, J. Borkowski ‘Code of Administrative Procedure. Commentary’, 7th edition of
C.H. Beck Publishing House, Warsaw 2005, p. 485). The same position was taken by the
Provincial Administrative Court in Kraków in its judgment of 27 February 2008 (III SA/Kr
762/2007): ‘Proceedings become devoid of purpose where one of the elements of the
substantive legal relationship is missing, with the result that the case cannot be settled by
a decision on the merits.’
The determination by a public authority of the existence of the condition referred to
in Article 105(1) of the Code of Administrative Procedure obliges it, as is emphasised in
legal literature and case-law, to discontinue the proceedings, since there are no grounds
for ruling on the merits of the case, and the continuation of the proceedings in such a case
would constitute its defectiveness, having a significant impact on the outcome of the case.
As indicated by the Supreme Administrative Court in Warsaw in its judgment of 26
September 2001 (V SA 381/01): ‘A decision to discontinue proceedings shall be issued by
a state administrative authority in accordance with Article 105(1) of the Code of
Administrative Procedure where proceedings have become devoid of purpose for any
reason, in particular where a party resigns from applying for a specific resolution, where
the granting of a specific right has become unnecessary or where the administrative
authority finds that there are manifestly no legal or factual grounds for examining the
merits of the case.’
In relation to the above, it should be noted that, in the course of the proceedings,
Lithuania SA found that the Complainant had no interest in continuing the proceedings,
and that, moreover, the subject matter of the complaint overlapped with the infringements
found by Lithuania SA in separate proceedings on 5 and 6 February 2024, and the fact
that the Company was subject to an administrative fine of EUR 2 385 276 on 2 July 2024
for those infringements, Lithuania SA considered those circumstances to be relevant
circumstances that form the basis for concluding the examination of the complaint, and
therefore decided, in the draft decision, to terminate the proceedings. Adoption by
Lithuania SA of the draft decision pursuant to Article 60(8) of the GDPR and the lack of a
relevant and reasoned objection to that draft decision within 4 weeks of its publication
means that the PUODO has agreed with Lithuania SA on the conclusion resulting from the
draft decision and is bound by it. Consequently, it must be stated that, following Lithuania
5
TRANSLATION
SA’s determination of the above circumstances in the draft decision, the procedure has
become devoid of purpose.
In this factual and legal situation, the President of the Personal Data Protection
Office ruled as in the operative part.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the
protection of personal data (Journal of Laws 2019, item 1781) in conjunction with Article
13(2), Article 53(1) and Article 54 of the Act of 30 August 2002 - Proceedings before
Administrative Courts (Journal of Laws 2024, item 935, as amended), a party dissatisfied
with this decision has the right to lodge a complaint with the Voivodship Administrative
Court in Warsaw within 30 days from the date of its delivery to the party. The complaint is
submitted via the President of the Personal Data Protection Office (address: Personal
Data Protection Office, ul. Stawki 2, 00-193 Warsaw). The entry from the complaint is 200
PLN. A party has the right to apply for exemption from court costs or the right to
assistance.
6