English translation
PRESIDENT
PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw, 30.01.2026.
DS.523.850.2022.
DECISION
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2025, item 1691) and Article 60(8) of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter:
GDPR), after conducting an administrative procedure regarding the complaint of
(residence: ) (hereinafter: the
Complainant) concerning irregularities in the processing of personal data by
(known earlier as ) (registered office:
) (hereinafter: the Company), consisting in the
failure to comply with the request to delete the personal data and user account of the
Complainant, the President of the Personal Data Protection Office (hereinafter also
referred to as the President of the PDPO)
discontinues the proceedings.
JUSTIFICATION
On February 1, 2022, the Office for Personal Data Protection received a complaint from
the Complainant regarding the failure of (formerly known as
) (registered office:
) (hereinafter: the Company). The Complainant indicated that despite sending a
request for deletion via the contact form, the Company did not comply with his request.
The President of the PDPO identified the case as cross-border in nature pursuant to
Article 4(23) of the GDPR and therefore referred the case to the Swedish supervisory
authority (Integritetsskyddsmyndigheten, registered office: Fleminggatan 14, 7th floor, 112
26, Stockholm, Sweden) (hereinafter: IMY) under the One-Stop-Shop (OSS) mechanism
resulting from Art. 60 of the GDPR through the Internal Market Information System
(hereinafter: IMI). Due to the fact that the Company's main organizational unit is located in
Personal Data Protection Office Tel. centr. (+48 22) 531 03 00
ul. Stanisława Moniuszki 1A
00-014 Warsaw www.uodo.gov.pl
Sweden, the examination of the case in question, due to the cross-border nature of the
complaint, fell within the competence of the IMY, which accepted the case for examination
as the lead supervisory authority on February 21, 2022.
In the course of the administrative proceedings, the President of the Personal Data
Protection Office established the following facts:
1. On January 24, 2022, the complainant requested the Company to delete his personal
data, including his user account, using the contact form on the Company's website
(evidence: complaint of February 1, 2022, with attachments);
2. On January 25, 2022, the Company responded to the Complainant, asking him to send
another email from the account associated with the Complainant's account with the
Company's service to confirm that he was its owner (evidence: complaint of February
1, 2022, with attachments);
3. On January 31, 2024, the President of the PDPO forwarded a letter from IMY to the
Complainant, containing explanations obtained from the Company, with a request for a
response. The Complainant did not collect the letter within the deadline, and it was
therefore returned to the President of the PDPO. (evidence: Letter from the President
of the PDPO dated January 31, 2024, return dated March 4, 2024)
4. On April 8, 2024, IMY, acting as the lead supervisory authority (within the meaning of
Article 56(1) of the GDPR), presented a draft decision with the following content:
Draft decision following proceedings pursuant to Article 60 of the GDPR -
This draft decision is a proposal for a decision under Article 60 GDPR in accordance with
the cooperation and consistency mechanisms provided for in Chapter VII of the GDPR.
The draft is shared with the supervisory authorities concerned in a formalised procedure,
which has the opportunity to comment and, where appropriate, to raise relevant and
reasoned objections to the decision.
This is not a final decision. The reasons and decision may be amended in whole or in part
depending on the outcome of the Article 60 procedure. After the procedure has been
concluded, the IMY or the supervisory authority with which the complaint was lodged will
adopt a final decision depending on the outcome of the case.
Decision of the Privacy Protection Authority
The Swedish Privacy Protection Authority (IMY) notes that the investigation in the case
has not shown that (556304-7041) has processed the
complainant’s personal data in breach of Article 17 of1 the GDPR in the manner claimed in
the complaint.
The case is closed.
Presentation of the supervisory case
IMY has initiated supervision against ( or the
Company) due to a complaint. The complaint has been submitted to IMY, as the lead
supervisory authority according to Article 56 of the General Data Protection Regulation
-2-
(GDPR). The transmission has been made by the supervisory authority of the country
where the complainant submitted his complaint (Poland).
IMY has made use of the cooperation and consistency mechanisms provided for in
Chapter VII of the GDPR. The concerned supervisory authorities have been the Data
Protection Authorities in Poland, Denmark and Finland.
What the Complainant states
The complainant states, essentially, as follows. On 24 January 2022, the complainant
requested erasure of his personal data and user account through customer
service. failed to comply with his request for erasure.
What has stated
stated, essentially, as follows. is the data controller for
the processing in question. The Customer service received the complainant’s message,
requesting the erasure of his data and his account on 24 January 2022. The complainant
received an automatic reply stating that his message had been received. The customer
service employee asked for verification of the complainant’s identity by e-mail on 25
January 2022. The complainant then verified his identity and requested erasure of his
account and data. On 25 January 2022, the customer service employee informed the
complainant that he has an active contract subscription which he had paid for until 15
February 2022. The customer service employee asked the complainant to confirm that he
wanted his data to be deleted immediately, which would also lead to his subscription being
terminated immediately instead of at the end of the minimum contract period, which was
15 February 2022. The complainant did not respond to the notification and did not confirm
whether he wanted his subscription to be terminated prematurely.
The erasure request was not carried out because the complainant did not confirm that the
contract with and subscription period would be terminated immediately and
prematurely. The complainant has actively renewed his contract with subscription until 31
December 2023. Erasure requests from customers who have an active contract, require
confirmation that access to the prepaid subscription is immediately terminated.
has not been able to fulfill the complainant’s request because he has an active
contract with an annual subscription and has not confirmed if he wishes to have his data
erased immediately, thus losing access to his prepaid subscription. cannot
therefore fulfill the complainant’s request as none of the grounds of Article 17(1) GDPR
applies until he has confirmed that the contract with will be terminated
prematurely. The legal basis for further processing of the complainant’s personal data is
based on Article 6(1)(b) of the GDPR. The processing is necessary for the performance of
a contract to which the data subject (complainant) is a party.
After received IMY’s supervisory letter, the complainant was contacted by
email on 27 October 2023 in order to receive confirmation if he wishes to terminate the
contract early. No reply was received from the complainant at the time of
reply to IMY on 6 November 2023. In support of the above measures,
-3-
provided copies of the correspondence between and the complainant,
together with a summary of the contractual period with the complainant.
The complainant has been given the opportunity to comment on the material in the
investigation.
Reasons for the decision
According to Article 17 of the GDPR, the data subject has the right to have his or her
personal data erased without undue delay under certain specified conditions, for example
if the data are no longer necessary for the purposes for which they have been collected or
if consent for processing is revoked.
Article 6 GDPR requires that the processor of personal data has a legal basis for the
processing, i.e. that at least one of the conditions of Article 6(1) is fulfilled. A legal basis for
processing personal data is when the processing is necessary for the performance of a
contract to which the data subject is a party pursuant to Article 6(1)(b) GDPR.
states that it has received the complainant’s request for erasure. However,
did not erase the complainant’s data as the complainant did not confirm that
he wished to terminate the contract with prematurely. states
that the complainant has had an ongoing contractual relationship with the company and
that the legal basis for the processing of the complainant’s personal data is Article 6(1)(b)
of the GDPR – the processing is necessary for the performance of a contract to which it is
a party.
IMY finds no reason to question that the complainant’s personal data have been
necessary for to process in order to fulfill a contract between the
complainant and the company. Against this background, it has not been clarified that there
were conditions to erase the complainant’s personal data pursuant to Article 17(1) of the
GDPR. IMY finds that the investigation in the case has not shown that has
processed the complainant’s personal data in breach of Article 17 of the GDPR in the
manner claimed in the complaint.
The case should therefore be closed.
(evidence: memo dated January 21, 2026)
5. On August 22, 2025, the President of the Personal Data Protection Office informed the
parties that sufficient evidence had been gathered to issue an administrative decision.
The complainant did not collect the shipment within the deadline, and therefore it was
returned to the President of the Personal Data Protection Office. (evidence: Letter from
the President of the PDPO dated August 22, 2025, return receipt dated September 23,
2025)
In view of the above, the President of the Personal Data Protection Office has
considered the following.
In accordance with Article 56(1) of the GDPR, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out
-4-
by that controller or processor in accordance with the procedure provided in Article 60.
Pursuant to Article 60(3) of the GDPR, the lead supervisory authority shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities
concerned. It shall without delay submit a draft decision to the other supervisory authorities
concerned for their opinion and take due account of their views. In accordance with Article
60(6) of the GDPR where none of the other supervisory authorities concerned has
objected to the draft decision submitted by the lead supervisory authority within the period
referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory
authorities concerned shall be deemed to be in agreement with that draft decision and
shall be bound by it.
In accordance with Article 60(7) of the GDPR the lead supervisory authority shall
adopt and notify the decision to the main establishment or single establishment of the
controller or processor, as the case may be and inform the other supervisory authorities
concerned and the Board of the decision in question, including a summary of the relevant
facts and grounds. The supervisory authority with which a complaint has been lodged shall
inform the complainant on the decision. However, pursuant to Article 60(8) of the GDPR,
by derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof.
The above-mentioned provisions have been analyzed by the European Data
Protection Board (hereinafter: the EDPB), which states in paragraph 225 of Guidelines
02/2022 on the application of Article 60 GDPR, “Thus, a decision dismissing or rejecting a
complaint (or parts of it) should be construed as a situation where the LSA has found, in
handling the complaint, that there is no cause of action regarding the complainant's claim,
and no action is taken in relation to the controller. In such case, the complaint has to be
dismissed or rejected via the decision adopted by the complaint receiving SA, as the case
may be."
EDPB in the above mentioned guidelines further states in point 238 that "The CSA,
when issuing a decision, must give full effect to the draft decision, which is binding on LSA
and other CSAs under Article 60(6) and/or the EDPB binding decision following Article
65(1)(a).”
IMY, acting as the lead supervisory authority pursuant to Article 56(1) of the GDPR,
submitted a draft decision pursuant to Article 60(3) of the GDPR, in which it indicated that
the draft decision was issued in accordance with Article 60(8) of the GDPR. The President
of the PDPO did not raise any justified objections relevant to the case. In view of the
content of Article 60(6) of the GDPR, this means that the President of the PDPO has
consulted with IMY on the draft decision and is bound by it.
Pursuant to Article 60(8) GDPR, the President of the PDPO, as the authority with
which the complaint was lodged, is competent to adopt the final decision on the case,
notify it to the Complainant and inform the controller thereof.
The President of the PDPO, as a public administration body, conducting
proceedings based on the provisions of the Act of June 14, 1960, Code of Administrative
Procedure (i.e., Journal of Laws of 2025, item 1691, as amended) (hereinafter: Kpa),
-5-
assesses on the basis of all the evidence whether a given circumstance has been proven.
Evidence in the proceedings may include, in particular, documents, witness statements,
expert opinions, and visual inspections (Article 75 § 1 Kpa). A public administration body
may consider the facts of the case to be established only on the basis of evidence that is
beyond doubt and may not rely on mere probability in this respect, unless the provisions of
the Kpa provide otherwise. As stated by the Supreme Administrative Court in its judgment
of July 9, 1999 (III SA 5417/98), “the authority conducting the proceedings must strive to
establish the material truth and, according to its knowledge, experience, and internal
conviction, assess the evidential value of individual pieces of evidence and the impact of
proving one circumstance on other circumstances.” In the same judgment, the Court also
ruled that in administrative proceedings, the principle that the burden of proof rests with
the party who derives legal consequences from a specific fact also applies.
With regard to the allegation that the Company failed to comply with the
Complainant's request to delete his personal data, it should be noted that the Company
communicated with the Complainant regarding his request, emphasizing that he had an
active subscription to the agreement, for which he paid until February 15, 2022. The
Company emphasized that the deletion of the data would result in the termination of the
contract and the cessation of the provision of services by the Company to the
Complainant, and asked him to confirm whether he still requested the deletion of his
personal data. The complainant did not respond and did not confirm whether he wanted to
terminate his subscription early. The company pointed out that, in addition to not
responding to the above correspondence, the complainant had actively extended his
contract with the company until December 31, 2023.
After receiving a written inquiry from IMY on October 27, 2023, the Company
contacted the Complainant again to confirm whether he wanted to terminate the
agreement early and have his data deleted. The Company did not receive any response
from the Complainant.
In light of the above findings and in the absence of additional information that could
lead IMY to question the Company's response, no violation was found to have been
committed by the Company in relation to this processing, and IMY closed its investigation.
In view of the above, it should be concluded that the proceedings in this regard are
irrelevant and should be discontinued due to the findings made by IMY. Pursuant to Art.
105 § of the Kpa, if proceedings become irrelevant for any reason, the administrative
authority shall issue a decision to discontinue the proceedings. In addition, it should be
noted that the subject matter of the proceedings is related to the application of substantive
administrative law provisions by a public authority. The doctrine indicates that "the
irrelevance of administrative proceedings, as provided for in Art. 105 § 1 of the Kpa,
means that one of the elements of the substantive legal relationship is missing, and
therefore it is not possible to issue a decision resolving the case by deciding on its merits.
The grounds for discontinuing proceedings may exist even before the proceedings are
initiated, which will only be revealed in the pending proceedings, and may also arise during
the proceedings, i.e. in a case already pending before the administrative authority" (B.
-6-
Adamiak, J. Borkowski, Administrative Procedure Code. Commentary, C. H. Beck,
Warsaw 2005, p. 486).
The determination by a public authority of the existence of the condition referred to
in Article 105 § 1 of the Kpa obliges it, as emphasized in doctrine and jurisprudence, to
discontinue the proceedings, since in the event of the existence of this condition there are
no grounds for deciding the case on its merits, and continuing the proceedings in such a
case would constitute a defect that would have a significant impact on the outcome of the
case. The irrelevance of the proceedings may also result from a change in the facts of the
case. This position of the authority is also reflected in the case law of the Supreme
Administrative Court, e.g. in the judgment of June 27, 1997 (I SA/Wr 871/96) of the
Supreme Administrative Court – Branch Office in Wrocław, which stated that “proceedings
are irrelevant when the authority clearly finds that there are no legal or factual grounds for
substantive consideration of the case.” This means that all elements of the legal and
factual situation under examination are such that proceedings aimed at clarifying all these
circumstances in the case are unnecessary.
In view of the above, the President of the Personal Data Protection Office decided
as stated in the introduction.
Under the authority of the President of the
Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
/electronically signed document/
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the
protection of personal data (Journal of Laws 2019, item 1781) in conjunction with Article
13(2), Article 53(1) and Article 54 of the Act of 30 August 2002 - Proceedings before
Administrative Courts (Journal of Laws 2024, item 935, as amended), a party dissatisfied
with this decision has the right to lodge a complaint with the Voivodship Administrative
Court in Warsaw within 30 days from the date of its delivery to the party. The complaint is
submitted via the President of the Personal Data Protection Office (address: Personal
Data Protection Office, ul. Stawki 2, 00-193 Warsaw). The entry from the complaint is 200
PLN. A party has the right to apply for exemption from court costs or the right to
assistance.
-7-