Cassation appeal to the Supreme Administrative Court regarding the disclosure of the victim's data

The President of the Personal Data Protection Office, Mirosław Wróblewski, lodged a cassation appeal with the Supreme Administrative Court in a case in which the Public Prosecutor's Office disclosed, during a press conference, the personal data of a person who had been granted the status of an injured party in proceedings. In September 2024, the President of the Personal Data Protection Office imposed a financial penalty on the National Public Prosecutor's Office pursuant to a decision issued, but the Voivodeship Administrative Court in Warsaw overturned this decision.

The information was disclosed at a press conference held by the National Public Prosecutor's Office on August 2, 2023, attended by Minister of Justice and Prosecutor General Zbigniew Ziobro and National Public Prosecutor Tomasz Szafrański. It was devoted to personnel decisions taken by the Poznań-Stare Miasto District Prosecutor's Office in connection with the case of an assault on a woman during a demonstration, during which an attempt was made to snatch her rainbow bag, associated with the LGBT community. The Poznań-Stare Miasto District Court in Poznań convicted the person responsible for the attack.

During the conference, the prosecutor from the National Prosecutor's Office, describing what he considered to be irregularities in the already closed proceedings, quoted excerpts from the files, including the name and surname of the woman who was the victim of the assault, a description of the course of the assault, and information that she had suffered damage to her health. In the opinion of the President of the Personal Data Protection Office, not only were her name and surname disclosed, but also information about her health and her views, which belong to a special category of data and are subject to enhanced protection under Article 9(1) of the GDPR.

Consequently, on September 2, 2024, the President of the Personal Data Protection Office issued a decision on this matter and imposed an administrative fine of PLN 85,000 on the National Public Prosecutor's Office. In the opinion of the President of the Personal Data Protection Office, the prosecutor had no legal basis for disclosing the data of the assaulted woman. More on the case: News and Events – UODO

The Public Prosecutor's Office appealed against this decision to the Voivodeship Administrative Court in Warsaw. The Voivodeship Administrative Court overturned the decision of the President of the Personal Data Protection Office, stating that “the disclosure to the media of information concerning the personal data of the victim contained in a final court judgment constitutes the performance of the tasks of the Public Prosecutor's Office. Therefore, in the opinion of the Court, this event cannot be covered by the protection of the GDPR.”

In his cassation appeal, the President of the Personal Data Protection Office pointed out that the context of the case in which the victim's personal data was disclosed was different from that assumed by the Voivodeship Administrative Court. It did not concern the analysis of court cases, but rather the widely commented on media decisions made by the Prosecutor General. If the purpose of the conference was to inform the public about the reasons for the personnel decisions made by the Public Prosecutor's Office, this is not a task related to the prosecution of crimes and the protection of the rule of law within the meaning of Article 2 or Article 3 of the Law on the Public Prosecutor's Office. Thus, the provisions of the GDPR apply to the disclosure of data, and not the Law on the Prosecutor's Office, as the authority emphasized in its cassation appeal.

Furthermore, in his cassation appeal, Mirosław Wróblewski, President of the Personal Data Protection Office, pointed out that on the day of the conference, the Public Prosecutor's Office did not have the authority to receive or investigate notifications of personal data breaches. Such powers were only added six months later. It cannot be argued that thePresident of the Personal Data Protection Office did not have the right to defend the rights of a person whose data had been disclosed without legal basis.

The President of the Personal Data Protection Office pointed out that the disclosure of the victim's personal data by the National Public Prosecutor's Office was unlawful. It is neither information from the preparatory proceedings nor information about her activities. The latter should concern actions that have already been carried out, not hypothetical ones. Moreover, the Voivodeship Administrative Court also ruled that the disclosure in question had no legal basis.

file ref. no.: II SA/Wa 1792/24, case at the Personal Data Protection Office DKN.5131.33.2023.(in Polish)