The Supreme Administrative Court upheld the decision of the Personal Data Protection Office (UODO)

The Supreme Administrative Court yesterday dismissed the cassation appeal of Bisnode company* (now Dun & Bradstreet) against the judgment of the Voivodeship Administrative Court in Warsaw.

After more than four years, the case related to the imposition of the first fine by the Polish supervisory authority has its finale. This is how long it took to impose a fine of just over PLN 943 000 on Bisnode, which obtained data from publicly available public registers, but did not inform the persons whose data it processed. As a result, those persons were not even aware that the controller was processing their personal data and thus they could not exercise their rights, e.g. to rectification of data or to object to further data processing.

This case aroused great emotions from the very beginning. Some accused the Personal Data Protection Office of hitting with this decision data brokers, engaged in the obtaining and processing of data for resale. However, UODO did not question the obtaining of data from publicly available public registers per se, but, after having conducted administrative proceedings it found that the company failed to inform the vast majority of persons whose data it had obtained about the fact that it had become the controller of their data and how it intended to further process them. Such information was only received by persons, whose e-mail addresses the company had in its possession.

In the opinion of the Personal Data Protection Office, a company obtaining personal data from publicly available public registers (e.g. National Court Register [KRS], Central Registration and Information on Business [CEIDG], National Business Registry [REGON]) must comply with the information obligation in relation to these persons set out in Article 14 of the GDPR, i.e. the General Data Protection Regulation, by directly providing information to the data subject.

The company appealed against this decision to the Voivodeship Administrative Court in Warsaw, which partially agreed with the authority (Ref. No. II SA/Wa 1030/19). The Court held that the company was obliged to comply with the information obligation under Article 14 of the GDPR, but only in relation to persons who were actively conducting economic activity or had suspended it at the time of issuance of the decision. However, the UODO’s decision referred not only to these persons, but also to persons who had conducted such activity in the past, and the Voivodeship Administrative Court annulled the decision with regard to the order to comply with the information obligation in relation to this group of persons. As the number of persons whose rights were violated had an impact on the size of the fine, the Court also annulled the decision in the part concerning the imposition of an administrative fine.

The Court pointed out, in particular, that in the context of the circumstance raised by the company in its complaint as to the lack of current addresses of natural persons who were sole proprietors in the past (had ceased their activity), the authority's findings as to the possibility of fulfilling the obligation to provide such persons with the relevant information would require prior findings as to the compliance of the processing (storage, use, disclosure, access) of such data with the EU law, i.e. the GDPR. Since the company claims that it does not have up-to-date addresses of those natural persons whose data it processes, it must be taken into account that the GDPR requires in particular that personal data be processed lawfully, fairly and in a transparent manner in relation to the data subject, and be accurate and, where necessary, kept up to date. In the Court's view, the above is closely linked to the information obligation and the authority, when reconsidering the case, will be obliged to take into account these indications of the Court.

However, the company filed a cassation appeal against this judgment, emphasising that it did not have to fulfil the information obligation with the use of traditional correspondence or telephone calls due to the exemption from this obligation on account of "disproportionate effort". However, the Supreme Administrative Court confirmed the correctness of the position presented in the decision of the President of the Personal Data Protection Office, as well as in the judgment of the Voivodeship Administrative Court, according to which the company should fulfil the information obligation in relation to persons conducting economic activity whose data it obtained. The Supreme Administrative Court emphasised that under the GDPR, the transparency of processing is a rule and any exceptions to this rule, including the exception concerning the exemption from the obligation to inform persons due to 'disproportionate effort', should be interpreted restrictively and, as a rule, should be applied to the processing of data for public purposes, in particular for statistical, research, archival or historical purposes.

Currently, the President of the Personal Data Protection Office is obliged to reconsider the case in the scope in which the Court annulled the administrative decision, i.e. in the scope concerning the processing of data of persons who conducted economic activity in the past and in the scope of the amount of the administrative fine imposed.

* Ref. No.: III OSK 2538/21