The Ombudsman supports the position of the President of the Personal Data Protection Office regarding personal data disclosed at a press conference

The Ombudsman has notified the Supreme Administrative Court of his intention to participate in the proceedings pending before it concerning the cassation appeal lodged by Mirosław Wróblewski, President of the Personal Data Protection Office, in a case relating to the disclosure of personal data by the National Public Prosecutor’s Office.

The Ombudsman requested that the cassation appeal lodged by the President of the Personal Data Protection Office be upheld in its entirety. In the grounds for his application to join the proceedings, the Ombudsman emphasised that the Voivodeship Administrative Court in Warsaw, whilst overturning the decision, had nevertheless accepted part of the arguments put forward by the President of the Personal Data Protection Office, pointing out that the disclosure of personal data by the National Public Prosecutor’s Office had taken place without a legal basis. Among other things, the interpretation of the incident (its context), the reason for convening the press conference, and, above all, the legal provisions under which the entire case should have been assessed proved to be contentious. The President of the Personal Data Protection Office unequivocally stated that the incident in question constituted a breach of personal data protection and should be assessed on the basis of the provisions of the GDPR, providing a comprehensive justification for his position. The Public Prosecutor’s Office, however, did not share the authority’s view, arguing that the disclosure of the victim’s personal data was not contrary to the applicable regulations, whilst citing the provisions of the Law on the Public Prosecutor’s Office and the provisions of the so-called Police Directive.

The case began in 2023, when the victim’s personal data was disclosed during a press conference held by the National Public Prosecutor’s Office. An investigation conducted by the President of the Personal Data Protection Office revealed that the National Public Prosecutor’s Office had breached the provisions of the GDPR. Not only was the personal data disclosed without a legal basis, but the data protection breach was also not reported to the President of the Personal Data Protection Office within 72 hours, nor was the victim herself (the person whose data was affected by the breach – i.e. whose data was disclosed) notified.

Following an investigation into the matter, the President of the Personal Data Protection Office issued a decision under which, amongst other things, he imposed an administrative fine of 85,000 PLN on the National Public Prosecutor’s Office and ordered it to notify the individual concerned of the breach. In the opinion of the President of the Personal Data Protection Office, the Prosecutor had no legal grounds to disclose personal data during a press conference. The Public Prosecutor’s Office appealed against this ruling to the Voivodeship Administrative Court. By a court judgement, the decision of the President of the Personal Data Protection Office was set aside and the administrative proceedings were discontinued.

The Voivodeship Administrative Court ruled that the disclosure of information to the media constituted the performance of the Public Prosecutor’s Office’s duties – and was therefore subject to the provisions of the Law on the Public Prosecutor’s Office, rather than the GDPR; consequently, the President of the Personal Data Protection Office had no jurisdiction to rule on this matter. However, in the opinion of the Voivodeship Administrative Court, the personal data should not have been disclosed. The President of the Personal Data Protection Office disagreed with this reasoning and lodged a cassation appeal with the Supreme Administrative Court.

More on the cassation appeal lodged by the President of the Personal Data Protection Office: News from 18 August 2025.

What the case was about

The information was disclosed during the aforementioned press conference, convened by the National Public Prosecutor’s Office, in the presence of the Minister of Justice and the Prosecutor General – Zbigniew Ziobro – and Prosecutor Tomasz Szafrański. The press conference took place on 2 August 2023 and focused on personnel decisions taken at the district prosecutor’s office.

During the conference, the prosecutor described concluded court cases and highlighted what he considered to be irregularities in the court’s sentencing. He then quoted extracts from the court records, including the victim’s first name and surname, the details of the assault and information about the injury sustained.

In the opinion of the President of the Personal Data Protection Office, the disclosure, during a press conference, of the victim’s personal data had no legal basis and therefore constituted a breach of the confidentiality of the victim’s data, the person whose data was disclosed. It is also relevant to the case that information relating to health and beliefs falls within a special category of data and is subject to enhanced protection under Article 9(1) of the GDPR. The processing of personal data is permitted only in specific situations and must be based on an appropriate legal basis – although in the case of special categories of data (e.g. health, information on sexual orientation or political views), their processing is, as a rule, prohibited unless the condition set out in Article 9(2) of the GDPR is met.

The President of the Personal Data Protection Office – the provisions of the GDPR apply

The supervisory authority emphasised that the manner and circumstances of the disclosure of personal data (the context of the case) clearly indicated the need to assess the incident in the light of the provisions of the GDPR. In the opinion of the President of the Personal Data Protection Office, the disclosed data could not be regarded as ‘information on the activities of the public prosecutor’s office’, as it originated from a concluded court case (rather than a pre-trial investigation), and the discussion took place in the context of justifying previously taken personnel decisions at the district public prosecutor’s office, which had brought the charges in the case in which the personal data had been disclosed; therefore, the provisions of the Law on the Public Prosecutor’s Office did not apply in this instance – only the GDPR.

The Voivodeship Administrative Court, however, took a different view, ruling that in the case in question, supervision of the processing of personal data fell to the internal supervisory bodies of the Public Prosecutor’s Office (as referred to in the Act on the Public Prosecutor’s Office), and not to the President of the Personal Data Protection Office. Therefore, in the court’s view, this incident cannot be covered by the protection afforded by the GDPR.

The President of the Personal Data Protection Office concluded that the context of this case was, however, significantly different from that assumed by the Voivodeship Administrative Court. The case did not concern the analysis of court proceedings, but rather personnel decisions taken by the Prosecutor General – which were subsequently widely reported in the media. If the purpose of the press conference was to provide information on the reasons behind the personnel decisions taken within the Public Prosecutor’s Office, this was not a task related to the prosecution of offences or the upholding of the rule of law within the meaning of Article 2 or Article 3 of the Law on the Public Prosecutor’s Office. Consequently – given the manner and circumstances of the incident – the provisions of the GDPR applied to the case, rather than those of the Law on the Public Prosecutor’s Office.

The President of the Personal Data Protection Office, in the text of the appeal on points of law (and previously in the decision), stated that the supervisory bodies of the Public Prosecutor’s Office did not have the authority to examine reports of personal data breaches.

The Ombudsman’s arguments in favour of applying the GDPR

In justifying his intervention in the court proceedings, the Ombudsman pointed out that the Voivodeship Administrative Court had misinterpreted the provisions.

The crux of the dispute, as the Ombudsman points out, boiled down to assessing whether the President of the Personal Data Protection Office had the competence to examine the case and assess the situation in the light of personal data protection legislation. According to the Ombudsman, the starting point for resolving this issue should be an analysis of the provisions of the GDPR and any limitations or exemptions to its application. Furthermore, in the Ombudsman’s view, the press conference in question did not fall within the scope of the Public Prosecutor’s Office’s remit (preventing crime, conducting investigations, and detecting and prosecuting criminal offences).

The Ombudsman also emphasised that, in this matter, the context of the rights of data subjects must not be overlooked. If one were to accept the broad interpretation of the provisions concerning the scope of the Public Prosecutor’s Office’s activities, as applied by the Voivodeship Administrative Court, this would consequently lead to an extension of the scope of supervision exercised by the Public Prosecutor’s Office. This would also have a negative impact on compliance with constitutional standards regarding the protection of rights set out in the GDPR and in the Constitution of the Republic of Poland.

Furthermore, the Ombudsman takes the view that the authorisation set out in the Act on the Public Prosecutor’s Office to disclose information to the media – concerning pre-trial proceedings and the activities of the Public Prosecutor’s Office – does not imply freedom to disclose all information held by the Public Prosecutor’s Office — including, for example, the personal data of parties to proceedings or special categories of data. This would, in fact, be contrary to the constitutional standard set out in the Constitution of the Republic of Poland. The personal data of parties to proceedings cannot be regarded as information concerning the activities of the Public Prosecutor’s Office within the meaning of Article 2 or Article 3 of the Act on the Public Prosecutor’s Office.

The Ombudsman pointed out (as the President of the Personal Data Protection Office had previously done) that the disclosure of data during broadcast conferences allows an unlimited number of viewers on television and online to access it. This therefore exacerbates the extent of the infringement of rights in cases where personal data is disclosed without a legal basis, as it facilitates the identification of individuals and, consequently, exposes them to secondary victimisation.

The Ombudsman, in supporting the position of the President of the Personal Data Protection Office, also pointed out that informing the public about a plan to take a legal action (an extraordinary appeal) is not tantamount to taking that action; it cannot therefore be regarded as an act of the Public Prosecutor’s Office within the meaning of Articles 2 and 3 of the Law on the Public Prosecutor’s Office. Furthermore, in this context, it is not at all necessary to consider the context of the press conference organised by the National Public Prosecutor’s Office or its main theme; rather, the mere fact that it constitutes a factual act of an informative, educational or promotional in nature, which cannot be equated with the legal measures listed in Article 3(1)(3) of the Law on the Public Prosecutor’s Office. This provision concerns, in fact, procedural measures at the disposal of the Public Prosecutor’s Office.