The President of the Polish SA will deal with the leakage of an activist's data

The President of the Polish SA will deal with the leakage of an activist's data from the State Sanitary Inspectorate. He withdraws the cassation appeal of his predecessor.

The case concerns the disclosure of the activist's personal data by TVP Info in 2020. At the time, the previous President of the Personal Data Protection Office refused to deal with the case for procedural reasons. When the court obliged him to do so after a request from the Commissioner for Human Rights, he filed a cassation appeal. This appeal was withdrawn by Mirosław Wróblewski, the current President of the Personal Data Protection Office, on 23 April 2024.

During the civic protests following the Constitutional Tribunal's ruling of 22 October 2020 restricting abortion law, TVP Info revealed the details of a well-known social activist. In the material from 16 December, the station made public her positive Covid test result. At the time, the person concerned herself did not know the result of the test - the data must have come from the State Sanitary Inspectorate. On top of that, TVP Info quoted the doctor's statement in the journalistic material: ‘the sowers of death walk in crowd’.

The situation occurred after the leader of the then ruling party, Jarosław Kaczyński, accused the protesters (in a televised speech on 27 October 2020) of creating an epidemiological threat (Article 165(1)(1) of the Penal Code). On 11 February 2021, the prosecutor charged the activist precisely under Article 165 of the Penal Code.

Earlier, on 19 January 2021 the then President of the Personal Data Protection Office, Jan Nowak, had refused to verify how medical data had been disclosed due to the lack of consent of the person concerned and lack of her data enabling her to request such a consent. The Commissioner for Human Rights challenged this decision before the administrative court. The Voivodeship Administrative Court in Warsaw agreed with the President of the Personal Data Protection Office, stating that in the case of administrative proceedings on the processing of a particular person's personal data, it is necessary to obtain the consent of the person. However, the GDPR also does not exclude conducting proceedings on the basis of information received from another public authority, in this case the Commissioner for Human Rights. But the President of the Personal Data Protection Office filed, against the decision of the Voivodeship Administrative Court, a cassation appeal, which is pending before the Supreme Administrative Court as of 2021. The President of the Personal Data Protection Office is now withdrawing this appeal.

Mirosław Wróblewski, the President of the Personal Data Protection Office, upholds his predecessor's argument, confirming that without the activist's consent he could not conduct proceedings based on the application of the Commissioner for Human Rights. At the same time, he admits that in his response to the 2021 cassation appeal, the Commissioner for Human Rights provided him with the activist's address, which gave him the opportunity to request such a consent.

The President of the Personal Data Protection Office obviously had no grounds to check the sources of the TVP Info journalists, as the GDPR does not apply to journalistic activities. What needs to be investigated, however, is how the data could have leaked out of the public records. To this end, the legality of the transfer of the data to the journalists by the personal data controller needs to be assessed, as well as the accuracy of the processing of the data in the sanitary ICT system.