The President of the PL SA files another complaint against the prosecutor’s decision

The President of the Personal Data Protection Office, Mirosław Wróblewski, has filed another complaint against the decision of the Warsaw-Śródmieście District Prosecutor’s Office refusing to initiate an investigation into a case concerning the suspected commission of an offence consisting in a Member of the Polish Parliament posting on the X platform a photograph of a private individual whose skin colour indicates a non-European origin.

The case dates back to March 2025, when the President of the Personal Data Protection Office, Mirosław Wróblewski, notified the Warsaw-Śródmieście District Prosecutor’s Office of a suspected criminal offence consisting in the processing of personal data where such processing was not permissible. The matter concerned the posting on the X platform, without a legal basis, by Mr Artur Szałabawka, a Member of the Polish Parliament and a user of the platform, of a photograph of a private individual whose skin colour indicates a non-European origin. This conduct was alleged to meet the statutory elements of a prohibited act as defined in Article 107 of the 2018 Act on the Protection of Personal Data.

The photograph was provided to the MP by an unidentified person, and that person’s message—concerning the bus route in Szczecin on which the man shown in the photograph was travelling, as well as the detail about a scar on his cheek—was also published in the post.

Following the publication, the person visible in the photograph was identified by internet users. As a consequence, further information about that person began to appear in the mass media, including details about their country of origin and occupation.

In April 2025, the President of the Personal Data Protection Office received a decision from the Warsaw-Śródmieście District Prosecutor’s Office refusing to initiate an investigation. The prosecutor’s office acknowledged that the MP had published an image of a man with a dark complexion, but concluded that the act was characterised by a negligible degree of social harm. In the prosecutor’s assessment, the action did not result in any real negative consequences either for the person photographed or for other individuals. It was also noted that the post had been removed shortly after its publication.

In May 2025, the President of the Personal Data Protection Office lodged a complaint against that decision. He pointed out that unlawful processing of personal data is a formal offence and therefore does not require the occurrence of a harmful effect to be considered committed. He also argued that it was unclear on what basis the prosecutor’s office had concluded that there were no negative consequences of the action, given that the publication of a post with a pejorative tone towards persons of non-European origin, as well as the subsequent media interest, could have caused at least psychological discomfort to the person concerned.

With regard to the issue of identification, the President of the Personal Data Protection Office recalled that, pursuant to Article 4(1) of Regulation (EU) 2016/679 (GDPR), personal data means any information relating to an identified or identifiable natural person (directly or indirectly). The fact that information about the person was posted by third parties is irrelevant. For identification purposes, the image of the man, the information about a scar on his cheek, and the indication of the bus route he was travelling on were sufficient. The removal of the post does not eliminate the effects, since identification had already taken place.

The President of the Personal Data Protection Office also emphasised that data concerning ethnic origin constitute special category data within the meaning of Article 9(1) of the GDPR and are subject to enhanced protection. In this context, it cannot be argued that the act was of negligible harmfulness, particularly in light of the context of the post, which could have fostered a sense of threat towards persons of foreign origin.

The prosecutor of the Warsaw-Śródmieście District Prosecutor’s Office did not allow the complaint and referred it to the Warsaw-Śródmieście District Court. In October 2025, the court set aside the contested decision and shared the reasoning of the President of the Personal Data Protection Office.

Despite this ruling, in November 2025 the prosecutor’s office again refused to initiate proceedings. It stated, among other things, that the court was not authorised to order the initiation of an investigation and had not specified what evidentiary actions should be taken. According to the prosecutor’s office, the act did not meet the elements of a criminal offence, as, in its view, no processing of data allowing the identification of the person without excessive effort had occurred.

The President of the Personal Data Protection Office considered this position incorrect and inconsistent with both the provisions of the law and established doctrine. He emphasised that, for the assessment of the act, it is irrelevant whether identification actually occurred; what matters is that it was possible, as the court also noted. The information contained in the post—concerning the city, district, bus route, and a distinguishing feature in the form of a scar—was sufficient to identify the individual.

In the assessment of the President of the Personal Data Protection Office, a criminal offence as defined in Article 107 of the Act on the Protection of Personal Data was committed, which is why the supervisory authority filed another complaint.