Lodge a complaint
NB: A complaint must be lodged in Polish.
In case of violation of the provisions of the Regulation of the European Parliament and of the Council 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) the data subject can lodge a complaint with the President of the Personal Data Protection Office (President of the Office). After having conducted the proceedings in the case, the President of the Office - if there has been a violation of the provisions – shall, by means of an administrative decision, order to restore compliance with the law in accordance with Art. 58 para. 2 of the GDPR. A natural person may lodge a complaint with the President of the Office if the irregularity concerns the processing of his/her personal data. If the complaint concerns the processing of personal data of another person, a power of attorney granted by that person to represent him/her in proceedings before the President of the Office is necessary.
Who can be a proxy?
- a natural person1;
- non-for-profit body, association or organization, which has statutory objectives which are in the public interest and is active in the field of the protection of data subjects' rights and freedoms.2
Object, before you lodge a complaint.
If the data controller does not know that you do not wish your data to be processed, the President of the Personal Data Protection Office might not be able to fulfil your request.
According to Art. 21 para. 2 and 3 of the GDPR, where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
As foreseen in Art. 58 para. 2 letter c, the corrective power of the supervisory authority to order the controller or the processor to comply with the data subject's requests to exercise his or her rights, requires the data subject to approach the controller/processor with his/her request first.
IMPORTANT: The data subject has the right to request the controller to erase his/her personal data without delay.
According to Art. 17 para. 1 letter c of the GDPR, the controller shall have the obligation to erase personal data without undue delay where the data subject objects to the processing pursuant to Art. 21 para. 1 or Art. 21 para. 2 of the GDPR.
In reference to the objection as laid down in Art. 21 para. 1, the controller can be relieved from this obligation if it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
In the event where data subject, pursuant to Art. 21 para. 2 of the GDPR, objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
1 The power of attorney must meet the requirements indicated in Art. 32-34 of the Act of 14 June 1960 - Code of Administrative Procedure (Journal of Laws of 2017, item 1257, with amendments)
2 Article 80 para. 1 of the GDPR