Chinese platform, Polish interest. After the data breach, the President of the Personal Data Protection Office intervenes with the Prosecutor General

The popular Chinese sales platform had a data breach that affected up to 1.3 million customers. The District Public Prosecutor’s Office for Warsaw Śródmieście discontinued the pre-trial investigation, but the President of the Personal Data Protection Office requests that the proceedings be resumed – he sent a letter in this case to the Prosecutor General. It is in the public interest, and therefore also in the interest of the Polish law enforcement authorities, to prosecute persons who illegally use personal data of Polish citizens," said Mirosław Wróblewski, President of the Personal Data Protection Office.

It all began on April 7, 2024, when the President of the Personal Data Protection Office began to receive media reports, and above all reports and complaints from people who are customers of the Chinese sales platform pandabuy.com. They concerned the personal data breach from this platform and their further processing on the internet. Most likely, on March 31, 2024, the personal data of 1.3 million customers from around the world, including Poland (several tens of thousands of data subjects) were made available on the network. The data included: name, email address, phone number, user ID, IP address, passwords, delivery address, order and payment details.

Interactive map with names and addresses

On 7 April 2024, on the newly created ‘lista-drillowcow.pl’ website, an interactive map of Poland appeared, on which the authors, using the data provided, included information such as names, surnames and delivery addresses. In the following days, the site was unavailable, but the map appeared at other addresses (‘drillowcow.club list’ and ‘drillowcow.xyz list’).

On 29 April 2024, the President of the Personal Data Protection Office sent a notification to the District Public Prosecutor’s Office for Warsaw Śródmieście – Północ of a justified suspicion of committing a criminal offence, indicating, inter alia, that in the established circumstances of the case, the processing of personal data of Polish customers of the pandabuy.com sales platform, including publication of the personal data on the aforementioned websites, by persons administering these websites took place without a legal basis.

In the opinion of the President of the President of the Personal Data Protection Office, unlawful processing of personal data of Polish customers by the aforementioned websites’ administrators took place as it fulfilled the condition resulting from Art. 107(1) of the Act on the Protection of Personal Data, and consequently the criminal offence has been committed.

The President of the Personal Data Protection Office is calling for action to be taken and for a comprehensive investigation into the matter. In response to this report, the District Prosecutor’s Office for Warsaw Śródmieście – Północ, stating in its notice of 22 June 2024 that it refused to initiate an investigation, citing Article 17 § 1(1) of the Code of Criminal Procedure as the basis, i.e. the lack of evidence sufficiently justifying a suspicion of a criminal offence. In view of the above, on 1 July 2024, the President of the Personal Data Protection Office lodged a complaint with the District Court for Warsaw Śródmieście, via the aforementioned District Public Prosecutor’s Office.

On 21 October 2024, the President of the Personal Data Protection Office received a ruling from the District Court for Warsaw  Śródmieście, by which the Court upheld the supervisory authority’s appeal, setting aside the contested ruling of the aforementioned public prosecutor’s office. In the Court’s view, ‘(…) the information and materials submitted by the President of the Personal Data Protection Office indicate a reasonable suspicion that an offence under Article 107(1) of the of the Act on the Protection of Personal Data has been committed. The information provided by the aforementioned authority was, moreover, corroborated in the course of police investigations. Consequently, having found that the information and materials provided in the report did not justify a refusal to initiate proceedings, the contested decision was set aside and the case was referred to the public prosecutor for the purposes of conducting proceedings”.

On 30 October 2025, the Personal Data Protection Office received the decision of The District Public Prosecutor’s Office for Warsaw Śródmieście of 25 September 2025 to discontinue the investigation. The text indicates that there is insufficient evidence to  justify the suspicion of committing a crime.

Unable to agree with this position, the President of the Personal Data Protection Office appealed against it to the Warsaw Regional Public Prosecutor’s Office.

On 17 March this year, the District Prosecutor’s Office in Warsaw received a decision of 13 March 2026 by which the prosecutor’s office decided not to grant the complaint of the President of the Regional Prosecutor’s Office in Warsaw, upholding the decision of the District Prosecutor’s Office in Warszawa Śródmieście – Północ of 25 September 2025 to discontinue the investigation.

On 17 March 2026, the Personal Data Protection Office received a decision from the Warsaw Regional Public Prosecutor’s Office dated 13 March 2026, pursuant to which the Public Prosecutor’s Office decided not to uphold the complaint lodged by the President of the Personal Data Protection Office, thereby upholding the decision of the District Public Prosecutor’s Office for Warsaw Śródmieście – Północ dated 25 September 2025 to discontinue the investigation.

A long list of arguments in favour of reopening the case

The President of the Personal Data Protection Office has now asked the Prosecutor General, Waldemar Żurek, to consider reopening the preliminary investigation. He justifies this, amongst other things, on the grounds that, in his view, the investigating officer and the Public Prosecutor at the Warsaw Regional Public Prosecutor’s Office who approved the decision dismissing the appeal against the decision of the District Public Prosecutor’s Office for Warsaw Śródmieście – Północ to discontinue the investigation failed to examine the entirety of the evidence comprehensively, and this results in a breach of the principle set out in Article 297 § 1(2), (4) and (5) of the Code of Criminal Procedure, as neither the perpetrator was identified nor apprehended, nor were the circumstances of the case clarified; furthermore, not all victims were identified and the extent of the damage was not established.

The evidence gathered in the course of the proceedings is incomplete because the authorities conducting the proceedings did not examine all possible directions (versions) of the case leading to the perpetrators of the act, in particular, steps were not taken – or not taken to a sufficient extent – to:

·       findings of entities registering and administering domains ("list-drillowcow.pl", etc.)

·       request hosting providers to provide data enabling the identification of the administrators of the above-mentioned websites

·       clarification of the circumstances and the channel through which the personal data, originating from a data breach at a Chinese platform operator, came into the possession of the individuals responsible for the websites in question

·       conducting a technical analysis that may lead to the identification of perpetrators

·       interviews with the victims whose data have been published.

In the opinion of the President of the Personal Data Protection Office, the assessment of the evidence gathered was arbitrary rather than independent.

The President of the Personal Data Protection Office once again points out that the arguments raised by the supervisory authority were not examined at any stage of the proceedings and, moreover, the law enforcement authorities refrained from examining the merits of the case, deciding to close it only on the basis of procedural grounds – which, in the President of the Personal Data Protection’s view, constitutes an incorrect decision.

There are still unexplored circumstances

The Chinese platform is certainly not interested in publishing information about data breach, because it is not in its interest, writes the President of the Personal Data Protection.  – However, it is in the public interest, and therefore also in the interest of the Polish law enforcement authorities, to prosecute persons who illegally use personal data of Polish citizens.

In the opinion of the President of the President of the Personal Data Protection Office, the law enforcement authorities have not exhausted the possibilities of seeking evidence in this case, and thus there are still unexplored circumstances that could affect the decision in question.