TRANSLATION
PRESIDENT
PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw, 31.12.2025
DS.523.6504.2021.
DECISION
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572), Article 60(8) of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter:
GDPR), after conducting an administrative procedure regarding the complaint of
(residence: ) concerning
irregularities in the processing of personal data by (registered office:
), President of the Personal Data Protection Office
discontinues the proceedings.
JUSTIFICATION
The Personal Data Protection Office received a complaint from
(residence: ) (hereinafter: Complainant)
concerning the processing of his personal data by (registered office:
) (hereinafter: Company). In the complaint, the
Complainant pointed out the suspicion of violation of the law with regard to the protection
of personal data by the financial operator , related to the violation of Article 5 of the
GDPR.
In the complaint, the Complainant indicated that he had been asked by the financial
operator to send an identity card and a bank statement in order to verify the data
and account on . The Complainant had funds in his virtual account and was forced
to send documents in order to withdraw funds. Unfortunately, the entity twice rejected the
submitted document and blocked the possibility of withdrawing funds from the account.
In view of the above, the Complainant requested the President of the Personal Data
Protection Office (hereinafter: PUODO) so that the Company deletes his personal data
from the system, and also sends information on what basis they carry out such verification
of users.
Personal Data tel. 22 531-09-88
Protection Office
ul. Stanisława Moniuszki 1A
www.uodo.gov.pl
00-014 Warsaw
TRANSLATION
In the course of the administrative proceedings, the PUODO established the
following facts:
1) On 8 October 2021, the Complainant lodged a complaint with the PUODO, in
which he forwarded his previous correspondence with the Company of 24
September 2021, where he sent the relevant documents to verify his identity but
his application was rejected and the entity blocked the funds in his account.
(evidence: Complainant’s letter of 08.10.2021)
2) On 22 November 2021, the PUODO identified the case as having a cross-border
nature in accordance with Article 4(23) of the GDPR. Therefore, on 22
November 2021, the case was referred through the Internal Market Information
System (hereinafter: IMI) to the State Data Protection Inspectorate of the
Republic of Lithuania (hereinafter: Lithuania SA) in order to accept the case to
be handled by this body as a leading supervisory authority within the meaning of
Article 56(1) of the GDPR. (evidence: memo of 22.11.2021; letter of 22
November 2021 from the PUODO)
3) On 23 November 2021, Lithuania SA identified itself in the IMI system in the
Article 61 Mutual Assistance Notification No 342268.1 as the lead supervisory
authority. Lithuania SA also asked the PUODO to provide the Complainant with
more information on the facts of the case, in particular: Provide evidence that the
Complainant has contacted the controller in order to exercise the right to erasure
(Article 17 GDPR). (evidence: e-mail from Lithuania SA dated 01.12.2021)
4) On 3 December 2021, Lithuania SA created a new notification in the IMI system
under Article 61 – Mutual Assistance with the number 346636.1, in which it sent
a letter to the Complainant to supplement the information in the case. On 10
January 2022, the PUODO informed Lithuania SA that it had forwarded the letter
to the Complainant. (evidence: memo of 03.12.2021)
5) On 08.03.2025, Lithuania SA created a new notification under Article 61 of the
VMN, number 374220.1, by which it sent a letter informing the complainant of
the progress of the case. Lithuania SA informed that during the complaint
handling period it requested information from the Company on 8 December 2021
related to the complaint. It received a reply on 23 December 2021. Given that
many other complaints were also received against the Company, in order to
gather objective and complete information needed to consider complaints and
take decisions, and in cooperation with the supervisory authorities of the
Member States of the European Union, Lithuania SA requested information from
the Company on 25 November 2021. Lithuania SA received a reply on 14
December 2021. Subsequently, Lithuania SA requested additional clarifications
from the Company on 19 January 2022. It received a reply on 18 February 2022
(evidence: service note of 08/03/2022 and letter from Lithuania SA of
08/03/2022)
2
TRANSLATION
6) The complainant did not reply to the letters of the PUODO of 10 January 2022
and 8 March 2022, under which letters from Lithuania SA were sent (evidence:
letters from the PUODO of 10 January 2022 and 8 March 2022)
7) 16.07.2025 Lithuania SA submitted a letter informing that in accordance with
Article 29(1)(4) of the Law on the Legal Protection of Personal Data of the
Republic of Lithuania (hereinafter ‘LLPPD‘)the supervisory authority shall adopt
a decision to terminate the examination of a complaint or part thereof if it is
established that it is not possible to examine the complaint or part thereof due to
a lack of information or other significant circumstances. Given that the complaint
was submitted to the national supervisory authority on 13.10.2021, Lithuania SA
asked the Complainant to reply to this letter by no later than 14 days after
service of this letter at the latest, indicating whether you wish to pursue further
examination of your complaint. Lithuanian SA informed the Complainant that if
no response is received by the specified date, or if the Complainant confirms
that further examination of the complaint is no longer relevant, Lithuanian SA will
treat this as a relevant circumstance constituting grounds for terminating the
examination of the complaint pursuant to Article 29(1)(4) of the LLPPD.
(evidence: letter from Lithuania SA dated 16.07.2025)
8) In the absence of a reply from the Complainant within the deadline, Lithuania
SA, via the IMI System, sent the PUODO a draft decision on 14 November 2025
in the notification with the number A60DD 848472.1 pursuant to Article 60(8)
GDPR, the content of which is presented below:
Lithuania SA states that the was submitted on 8 October 2021, and that the
Complainant has not expressed any further interest in pursuing the case since that time, the
Lithuania SA contacted the Polish supervisory authority on the basis of the mutual
assistance procedure with a request to contact the Complainant and inquire about the
current relevance of his Complaint (Article 61(1) of the GDPR).
On 11 September 2025, the Polish supervisory authority informed the Lithuanian SA
that, after contacting the Complainant and giving him a time limit of 14 days to respond on
the relevance of the Complaint, the Complainant did not respond within the set time limit.
Article 29(1)(4) of the Republic of Lithuania Law on Legal Protection of Personal Data
(“LLPPD”) provides that the supervisory authority shall take a decision to terminate the
examination of a complaint or part thereof if, during the examination of a complaint or part
thereof, it becomes evident that the complaint or part thereof cannot be considered due to
lack of information or other significant circumstances.
In view of the fact that the Complaint was submitted on 8 October 2021, and that the
Complainant did not reply to the letter from the Polish supervisory authority regarding the
relevance of the complaint, the Inspectorate considers these to be significant circumstances
constituting grounds for terminating the examination of the Complaint under Article 29(1)(4)
of the LLPPD.
In accordance with the above, as well as with Article 29(1)(4) of the LLPPD and
Articles 60(3) and 60(8) of the GDPR, Lithuania SA decided to terminate the examination of
the Complainant’s complaint.
3
TRANSLATION
(evidence: memo of 19.11.2025)
After examining all the evidence gathered in the case, the PUODO weighed the
following.
In accordance with Article 56(1) of the GDPR, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out
by that controller or processor in accordance with the procedure provided in Article 60.
Pursuant to Article 60(3) of the GDPR, the lead supervisory authority shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities
concerned. It shall without delay submit a draft decision to the other supervisory authorities
concerned for their opinion and take due account of their views. In accordance with Article
60(6) of the GDPR where none of the other supervisory authorities concerned has
objected to the draft decision submitted by the lead supervisory authority within the period
referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory
authorities concerned shall be deemed to be in agreement with that draft decision and
shall be bound by it.
In accordance with Article 60(7) of the GDPR the lead supervisory authority shall
adopt and notify the decision to the main establishment or single establishment of the
controller or processor, as the case may be and inform the other supervisory authorities
concerned and the Board of the decision in question, including a summary of the relevant
facts and grounds. The supervisory authority with which a complaint has been lodged shall
inform the complainant on the decision. However, pursuant to Article 60(8) of the GDPR,
by derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof.
The above-mentioned provisions have been analyzed by the European Data
Protection Board (hereinafter: the EDPB), which states in paragraph 225 of Guidelines
02/2022 on the application of Article 60 GDPR, “Thus, a decision dismissing or rejecting a
complaint (or parts of it) should be construed as a situation where the LSA has found, in
handling the complaint, that there is no cause of action regarding the complainant's claim,
and no action is taken in relation to the controller. In such case, the complaint has to be
dismissed or rejected via the decision adopted by the complaint receiving SA, as the case
may be."
EDPB in the above mentioned guidelines further states in point 238 that "The CSA,
when issuing a decision, must give full effect to the draft decision, which is binding on LSA
and other CSAs under Article 60(6) and/or the EDPB binding decision following Article
65(1)(a).”
Lithuania SA, acting as lead supervisory authority pursuant to Article 56(1) GDPR,
transmitted on 9 April 2024, pursuant to Article 60(3) GDPR, a draft decision under
notification 60DD number 626110.1. Within this notification, Lithuania SA indicated that the
draft decision is issued in accordance with Article 60(8) GDPR. The PUODO accepted the
4
TRANSLATION
draft decision and did not express any reasoned and relevant objection to it. Having regard
to the content of Article 60(6) GDPR, this means that the PUODO has agreed with the
Lithuania SA on the draft decision and is bound by it.
Pursuant to Article 60(8) GDPR, the PUODO, as the authority with which the
complaint was lodged, is competent to adopt the final decision on the case, notify it to the
Complainant and inform the controller thereof.
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572) (hereinafter: CAP) , the administrative procedure is
discontinued when it is devoid of purpose. Under that provision, where proceedings have
become devoid of purpose in whole or in part for any reason, the public authority is to
issue a decision to discontinue the proceedings in whole or in part, as appropriate. The
wording of that provision leaves no doubt that, if the proceedings are found to be devoid of
purpose, the authority conducting those proceedings is obliged to discontinue them. At the
same time, the subject-matter literature indicates that the devoid of purpose of the
administrative procedure, as provided for in Article 105(1) of the Code of Administrative
Procedure, means that one of the elements of the substantive legal relationship is missing,
and therefore it is not possible to issue a decision settling the case by ruling on its merits
(B. Adamiak, J. Borkowski ‘Code of Administrative Procedure. Commentary’, 7th edition of
C.H. Beck Publishing House, Warsaw 2005, p. 485). The same position was taken by the
Provincial Administrative Court in Kraków in its judgment of 27 February 2008 (III SA/Kr
762/2007): ‘Proceedings become devoid of purpose where one of the elements of the
substantive legal relationship is missing, with the result that the case cannot be settled by
a decision on the merits.’
The determination by a public authority of the existence of the condition referred to
in Article 105(1) of the Code of Administrative Procedure obliges it, as is emphasised in
legal literature and case-law, to discontinue the proceedings, since there are no grounds
for ruling on the merits of the case, and the continuation of the proceedings in such a case
would constitute its defectiveness, having a significant impact on the outcome of the case.
As indicated by the Supreme Administrative Court in Warsaw in its judgment of 26
September 2001 (V SA 381/01): ‘A decision to discontinue proceedings shall be issued by
a state administrative authority in accordance with Article 105(1) of the Code of
Administrative Procedure where proceedings have become devoid of purpose for any
reason, in particular where a party resigns from applying for a specific resolution, where
the granting of a specific right has become unnecessary or where the administrative
authority finds that there are manifestly no legal or factual grounds for examining the
merits of the case.’
In relation to the above, it should be noted that during the proceedings Lithuania SA
established that the Complainant did not express interest in continuing the proceedings
and therefore decided to terminate the proceedings in the draft decision. Adoption by
Lithuania SA of the draft decision pursuant to Article 60(8) of the GDPR and lack of a
reasoned and relevant objection to that draft decision within 4 weeks of its publication
means that the PUODO has agreed with Lithuania SA on the resolution of the resulting
5
TRANSLATION
draft decision and is bound by it. Consequently, it should be noted that, following the
finding by Lithuania SA that the Complainant did not express interest in continuing the
proceedings, the proceedings became devoid of purpose.
In this factual and legal situation, the President of Personal Data Protection Office
ruled as in the operative part.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the
protection of personal data (Journal of Laws 2019, item 1781) in conjunction with Article
13(2), Article 53(1) and Article 54 of the Act of 30 August 2002 - Proceedings before
Administrative Courts (Journal of Laws 2024, item 935, as amended), a party dissatisfied
with this decision has the right to lodge a complaint with the Voivodship Administrative
Court in Warsaw within 30 days from the date of its delivery to the party. The complaint is
submitted via the President of the Personal Data Protection Office (address: Personal
Data Protection Office, ul. Stawki 2, 00-193 Warsaw). The entry from the complaint is 200
PLN. A party has the right to apply for exemption from court costs or the right to
assistance.
6