Administrative fine for the Commander-in-Chief of the Polish Police

Administrative fine for the Commander-in-Chief of the Polish Police for disclosing data of a citizen at a press conference.

The President of the Personal Data Protection Office, Mirosław Wróblewski, imposed a fine of PLN 75 000 on the Commander-in-Chief of the Police for disclosing data and information at a press conference on the health of a woman who carried out a pharmacological abortion, and the authorities wanted to determine whether someone had assisted her.

The case concerns the incident from 2023. Media revealed at that time that a woman who had been in contact with 112 emergency telephone number and reported that she had psychological difficulties and had previously removed her pregnancy by pharmacological means, ended up in the hospital, where police officers soon appeared. They took her laptop and her mobile phone, ordered to take all her clothes off and wanted to be present during the medical test.

The media named the woman and the city where the incident occurred. She appeared in front of the cameras, revealing her image.

At that time, the then Commander-in-Chief of the Police convened a press conference and, explaining the actions of the subordinates, also disclosed information about the woman’s health and other data about her, without having any basis for doing so. The Commander-in-Chief disclosed them in a specific context – when the public was aware of her data and the case. The information provided by him could therefore be linked to a specific person. He also provided data which she had not previously disclosed, such as information on psychiatric treatment, which is in breach of the prohibition on the processing of health data stated in Article 9(1) of the GDPR, as well as information on the end of her relationship, the place of residence, type of home and the legal title to the premises, what breached Article 6(1) GDPR.

When examining the case following a complaint from this woman, the President of the Personal Data Protection Office found that the provisions of the GDPR had been infringed (Article 6(1) and 9(1)) and imposed a fine of PLN 75 000 on the Commander-in-Chief of the Police

The President of the Personal Data Protection Office concludes that this infringement of the GDPR is of a serious nature. The personal data of the person to whom the Police were supposed to provide assistance was made available to the public without a legal basis. The Commander-in-Chief of the Police, as the public authority, competent for the protection of human security and the maintenance of public security and public order, at the head of the formation intended to carry out these tasks, is the body which should pay particular attention to the welfare of such persons and the security of their personal data.

Making the data available by the Commander-in-Chief in breach of the GDPR (without a legal basis) during the conference entails not only a potential but also a real possibility for third parties to use the data without the knowledge and consent of the data subject, and therefore entails a risk of damage, in particular in the form of discrimination, loss of reputation and loss of control over his/her own data.

The President of the Personal Data Protection Office states that in this case the Police cannot justify its actions by provisions which exclude the GDPR and allow the processing of personal data for the purpose of ‘identifying, preventing, detecting and combating criminal offences’. The emergency telephone number –112 recording that initiated the case concerned the possibility of committing suicide, which is not a criminal offence. Thus, the information on the complainant was not collected by the Police for the purposes set out in Article 1(1) of the Act of 14 December 2018 on the protection of personal data processed in connection with preventing and combating crime, so that, in the opinion of the President of the Personal Data Protection Office, that law and the Police’s reliance on an exemption were not applicable in the case.

Moreover, the information disclosed at the conference was not, as the Commander-in-Chief of the Police explained, ‘press material’. The press conference is not an activity of the Commander-in-Chief, which consists ‘in the drafting, preparation, production or publication of press material’, so that the Commander-in-Chief of the Police could not defend himself that the information disclosed at the conference constituted press material within the meaning of the Press Law which had been made available in the course of the press activity of the Police under the Press Law, which precludes the application of Articles 5 to 9 of the GDPR to that material.

The Commander-in-Chief of the Police, in accordance with Article 5(1) of the Police Act – is the central government administration body responsible for protecting human safety and maintaining security and public order. Public authorities, and thus the Commander-in-Chief, are not beneficiaries of the freedom of the press and other social media as defined in Article 14 of the Polish Constitution and of freedom of expression (Article 54 of the Polish Constitution).

In the view of the President of the Personal Data Protection Office, the administrative fine will, in these specific circumstances, fulfil an educational but also preventive function. It will in fact indicate to both the Commander-in-Chief and the other controllers, the responsibility of the public authorities, for unlawful acts carried out by non-arbitrary use of their powers and the possibilities which that authority affords.

An administrative fine was imposed on the controller, which in this case is a public authority. In such a situation, it is possible to seek reimbursement from specific individuals who, by their conduct, have caused breaches of personal data protection rules, on a civil basis.

Decision in Polish: DS.523.4750.2023