The President of the Personal Data Protection Office reprimands the Mayor of Wejherowo for disclosing personal data

The Mayor of Wejherowo disclosed an unredacted request for access to public information submitted by one of the city’s residents to the company to which the questions related. This occurred because the owner of that company had also submitted a request asking whether, and to whom, the Municipal Office had disclosed information concerning his company. The Mayor incorrectly handled both requests as part of a single administrative proceeding and, as a result, disclosed the resident’s personal data to the business owner.

The case was examined by the Personal Data Protection Office following a complaint filed by a resident of Wejherowo against the city’s Mayor. The resident had submitted a request to the Mayor of Wejherowo for access to public information concerning agreements allegedly concluded by the local government with a particular company, as well as copies of invoices. However, the response letter contained a note indicating that the correspondence had also been sent to the company referred to in the complainant’s request. As a result, the complainant’s personal data were disclosed to the company.

The Mayor explained that the owner of the company had also submitted a request for access to public information, asking whether the Municipal Office had disclosed any information concerning agreements with his company. The Mayor took the view that the matter should be handled in accordance with the Code of Administrative Procedure, given that more than one applicant was involved.

Following its examination of the case, the President of the Personal Data Protection Office pointed out that the procedure for handling a request for access to public information does not constitute administrative proceedings within the meaning of the Code of Administrative Procedure. Rather, it is a separate, information-based procedure governed by the provisions on access to public information.

The submission of two or more requests for access to public information, even where they concern the same or a similar scope of information, does not result in a single, joint procedure being conducted. Each request for access to public information constitutes a separate request and must be considered independently. Furthermore, as the data controller, the Mayor is subject to the obligations arising from the GDPR, which require personal data processing to be limited to what is necessary.

In this case, the Mayor’s incorrect interpretation of the applicable provisions resulted in the applicant’s personal data being disclosed to the business owner without first being anonymised. Consequently, the complainant’s personal data were disclosed without a legal basis, in breach of the confidentiality principle set out in the GDPR.