TRANSLATION
PRESIDENT
PERSONAL DATA
PROTECTION OFFICE
Mirosław Wróblewski
Warsaw, 30.01.2026
DS.523.6486.2021.
DECISION
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572), Article 60(8) of Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of natural
persons with regard to the processing of personal data and on the free movement of such
data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter:
GDPR), after conducting an administrative procedure regarding the complaint of
(residence: ) concerning irregularities in the
processing of personal data by (registered office:
), President of the Personal Data Protection Office
discontinues the proceedings.
JUSTIFICATION
The Personal Data Protection Office received a complaint from
(residence: ) (hereinafter: Complainant) concerning the
processing of her personal data by (registered office:
) (hereinafter: Company).
In the content of the complaint, the Complainant indicated that the Company
requested data, including photos of a current identity document, not required at the time of
opening an account, in order to allegedly confirm her reliability, for the purpose of
transferring the collected funds to a bank account. The Complainant’s failure to comply
resulted in the blocking of its funds in its account. The Complainant also refers to the
suspicion that her data, which were provided to the Company, were made available to third
parties, which resulted in calls from fraudsters impersonating bank employees from the
security department, with information that someone from the Complainant’s account made
a suspicious transfer and attempted to extort data under this pretext in order to steal funds
from the bank account.
In the light of the above, the Complainant lodged a complaint with the President of
the Office for Personal Data Protection (hereinafter: President of UODO) for intervention.
Personal Data tel. 22 531-09-88
Protection Office
ul. Stanisława Moniuszki 1A
www.uodo.gov.pl
00-014 Warsaw
TRANSLATION
In the course of the administrative proceedings, the PUODO established the
following facts:
1) On 25 September 2021, the Complainant lodged a complaint with the President
of the UODO, in which she forwarded her previous correspondence with the
Company of 21 September 2021, under which she sent the relevant documents
to verify her identity, but the Complainant’s application was rejected and funds in
her account were blocked. (evidence: Complainant’s letter of 25 September
2021)
2) 08.12.2021 The President of UODO identified the case as having a cross-border
nature in accordance with Article 4(23) of the GDPR. Therefore, on 09.12.2021,
the case was referred through the Internal Market Information System
(hereinafter: IMI) to the State Data Protection Inspectorate of the Republic of
Lithuania (hereinafter: Lithuania SA) in order to accept the case to be handled
by this body as a leading supervisory authority within the meaning of Art. 1 of the
GDPR. (evidence: memo of 08.12.2021)
3) 03.01.2022 Lithuania SA agreed to accept the case as the lead supervisory
authority and in the notification with the number 61 VMN 354425.1 sent a letter
informing the complainant about the acceptance of the case for consideration,
together with an annex informing about the processing of personal data by
Lithuania SA and about the rights: to bring an action in civil proceedings before
the court and to appeal against the act and/or inaction of Lithuania SA in
accordance with the procedure provided for in the Law of the Republic of
Lithuania on Administrative Proceedings. (evidence: letter of 10.01.2022 and
memo of 11.01.2022)
4) 22.07.2025 Lithuania SA submitted a letter informing that in accordance with Art.
Paragraph 1(4) of the Law on the Legal Protection of Personal Data of the
Republic of Lithuania (‘LLPPD’) provides that the supervisory authority is to
decide to terminate the handling of a complaint or part thereof if it is established
that the handling of the complaint or part thereof is not possible due to a lack of
information or other relevant circumstances. Lithuania SA requested to reply to
this letter no later than 14 days after service of this letter, indicating whether the
Complainant would like to continue the examination of the complaint. Lithuania
SA informed that in the absence of a reply within the given deadline or
confirmation that the further processing of the complaint is no longer relevant,
Lithuania SA will treat this as an important circumstance constituting the basis
for the conclusion of the complaint under Art. 1(4) of the LLPPD. (evidence:
letter from the President of the UODO of 22 July 2025)
5) In the absence of a reply from the Complainant within the deadline, Lithuania
SA, via the IMI System, sent the President of the UODO a draft decision on 14
November 2025 in the notification with the number A60DD 848482.1, the
content of which is referred below:
2
TRANSLATION
Lithuania SA found that, in its complaint, the Complainant indicated that, on 7 September
2021, she had been informed that she had reached the transaction limit and was required
to provide a copy of its identity card in order to continue to use the integrated payment
services available on the platform. The Complainant further claimed that such processing of
its personal data was unlawful and uncertain.
Given that the Complaint was lodged on 25 September 2021 and the Complainant has not
since expressed any further interest in pursuing the case, Lithuania SA contacted the Polish
supervisory authority on the basis of the mutual assistance procedure with a request to
contact the Complainant and enquire about the current relevance of its complaint (Art. 61(1)
of the GDPR).
On 11 September 2025, the Polish supervisory authority informed the Lithuanian SA that,
after contacting the Complainant and giving her a time limit of 14 days to respond on the
relevance of the Complaint, the Complainant did not respond within the set time limit.
Article 29(1)(4) of the Republic of Lithuania Law on Legal Protection of Personal Data
(“LLPPD”) provides that the supervisory authority shall take a decision to terminate the
examination of a complaint or part thereof if, during the examination of a complaint or part
thereof, it becomes evident that the complaint or part thereof cannot be considered due to
lack of information or other significant circumstances.
In view of the fact that the Complaint was submitted on 25 September 2021, and that the
Complainant did not reply to the letter from the Polish supervisory authority regarding the
relevance of the complaint, the Inspectorate considers these to be significant circumstances
constituting grounds for terminating the examination of the Complaint under Article 29(1)(4)
of the LLPPD.
In accordance with the above, as well as with Article 29(1)(4) of the LLPPD and Articles
60(3) and 60(8) of the GDPR, Lithuania SA decided to terminate the examination of the
Complainant’s complaint.
(evidence: memo of 19.11.2025)
After examining all the evidence gathered in the case, the PUODO weighed the
following.
In accordance with Article 56(1) of the GDPR, the supervisory authority of the main
establishment or of the single establishment of the controller or processor shall be
competent to act as lead supervisory authority for the cross-border processing carried out
by that controller or processor in accordance with the procedure provided in Article 60.
Pursuant to Article 60(3) of the GDPR, the lead supervisory authority shall, without delay,
communicate the relevant information on the matter to the other supervisory authorities
concerned. It shall without delay submit a draft decision to the other supervisory authorities
concerned for their opinion and take due account of their views. In accordance with Article
60(6) of the GDPR where none of the other supervisory authorities concerned has
objected to the draft decision submitted by the lead supervisory authority within the period
referred to in paragraphs 4 and 5, the lead supervisory authority and the supervisory
authorities concerned shall be deemed to be in agreement with that draft decision and
shall be bound by it.
3
TRANSLATION
In accordance with Article 60(7) of the GDPR the lead supervisory authority shall
adopt and notify the decision to the main establishment or single establishment of the
controller or processor, as the case may be and inform the other supervisory authorities
concerned and the Board of the decision in question, including a summary of the relevant
facts and grounds. The supervisory authority with which a complaint has been lodged shall
inform the complainant on the decision. However, pursuant to Article 60(8) of the GDPR,
by derogation from paragraph 7, where a complaint is dismissed or rejected, the
supervisory authority with which the complaint was lodged shall adopt the decision and
notify it to the complainant and shall inform the controller thereof.
The above-mentioned provisions have been analyzed by the European Data
Protection Board (hereinafter: the EDPB), which states in paragraph 225 of Guidelines
02/2022 on the application of Article 60 GDPR, “Thus, a decision dismissing or rejecting a
complaint (or parts of it) should be construed as a situation where the LSA has found, in
handling the complaint, that there is no cause of action regarding the complainant's claim,
and no action is taken in relation to the controller. In such case, the complaint has to be
dismissed or rejected via the decision adopted by the complaint receiving SA, as the case
may be."
EDPB in the above mentioned guidelines further states in point 238 that "The CSA,
when issuing a decision, must give full effect to the draft decision, which is binding on LSA
and other CSAs under Article 60(6) and/or the EDPB binding decision following Article
65(1)(a).”
Lithuania SA, acting as lead supervisory authority pursuant to Article 56(1) GDPR,
transmitted on 9 April 2024, pursuant to Article 60(3) GDPR, a draft decision under
notification 60DD number 626110.1. Within this notification, Lithuania SA indicated that the
draft decision is issued in accordance with Article 60(8) GDPR. The PUODO accepted the
draft decision and did not express any reasoned and relevant objection to it. Having regard
to the content of Article 60(6) GDPR, this means that the PUODO has agreed with the
Lithuania SA on the draft decision and is bound by it.
Pursuant to Article 60(8) GDPR, the PUODO, as the authority with which the
complaint was lodged, is competent to adopt the final decision on the case, notify it to the
Complainant and inform the controller thereof.
Pursuant to Article 105(1) of the Code of Administrative Procedure of 14 June 1960
(Journal of Laws 2024, item 572) (hereinafter: CAP) , the administrative procedure is
discontinued when it is devoid of purpose. Under that provision, where proceedings have
become devoid of purpose in whole or in part for any reason, the public authority is to
issue a decision to discontinue the proceedings in whole or in part, as appropriate. The
wording of that provision leaves no doubt that, if the proceedings are found to be devoid of
purpose, the authority conducting those proceedings is obliged to discontinue them. At the
same time, the subject-matter literature indicates that the devoid of purpose of the
administrative procedure, as provided for in Article 105(1) of the Code of Administrative
Procedure, means that one of the elements of the substantive legal relationship is missing,
and therefore it is not possible to issue a decision settling the case by ruling on its merits
4
TRANSLATION
(B. Adamiak, J. Borkowski ‘Code of Administrative Procedure. Commentary’, 7th edition of
C.H. Beck Publishing House, Warsaw 2005, p. 485). The same position was taken by the
Provincial Administrative Court in Kraków in its judgment of 27 February 2008 (III SA/Kr
762/2007): ‘Proceedings become devoid of purpose where one of the elements of the
substantive legal relationship is missing, with the result that the case cannot be settled by
a decision on the merits.’
The determination by a public authority of the existence of the condition referred to
in Article 105(1) of the Code of Administrative Procedure obliges it, as is emphasised in
legal literature and case-law, to discontinue the proceedings, since there are no grounds
for ruling on the merits of the case, and the continuation of the proceedings in such a case
would constitute its defectiveness, having a significant impact on the outcome of the case.
As indicated by the Supreme Administrative Court in Warsaw in its judgment of 26
September 2001 (V SA 381/01): ‘A decision to discontinue proceedings shall be issued by
a state administrative authority in accordance with Article 105(1) of the Code of
Administrative Procedure where proceedings have become devoid of purpose for any
reason, in particular where a party resigns from applying for a specific resolution, where
the granting of a specific right has become unnecessary or where the administrative
authority finds that there are manifestly no legal or factual grounds for examining the
merits of the case.’
In relation to the above, it should be noted that during the proceedings Lithuania SA
established that the Complainant did not express interest in continuing the proceedings
and therefore decided to terminate the proceedings in the draft decision. Adoption by
Lithuania SA of the draft decision pursuant to Article 60(8) of the GDPR and lack of a
reasoned and relevant objection to that draft decision within 4 weeks of its publication
means that the PUODO has agreed with Lithuania SA on the resolution of the resulting
draft decision and is bound by it. Consequently, it should be noted that, following the
finding by Lithuania SA that the Complainant did not express interest in continuing the
proceedings, the proceedings became devoid of purpose.
In this factual and legal situation, the President of Personal Data Protection Office
ruled as in the operative part.
Under the authority of the President
of the Personal Data Protection Office
Head of the Cross-border Proceedings Unit
International Cooperation Department
The decision is final. On the basis of Article 7(2) of the Act of 10 May 2018 on the protection of personal data (Journal
of Laws 2019, item 1781) in conjunction with Article 13(2), Article 53(1) and Article 54 of the Act of 30 August 2002 -
Proceedings before Administrative Courts (Journal of Laws 2024, item 935, as amended), a party dissatisfied with this
decision has the right to lodge a complaint with the Voivodship Administrative Court in Warsaw within 30 days from the
date of its delivery to the party. The complaint is submitted via the President of the Personal Data Protection Office
(address: Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warsaw). The entry from the complaint
is 200 PLN. A party has the right to apply for exemption from court costs or the right to assistance.
5