Lodging a complaint in a traditional form, including for the record
Lodging a complaint in a traditional form, including for the record at the seat of the President of the Office
NB: A complaint must be lodged in Polish.
Each complaint lodged with the President of the Office must contain:
- name, surname and address of residence of the complainant;
- handwritten signature;
- indication of the entity against which the complaint is lodged (full name / name and surname and address of the seat/residence);
- detailed description of the violation;
- request, i.e. indication of what action the applicant expects from the authority (e.g. deletion of data, fulfillment of the information obligation, rectification of data, limitation of data processing, etc.).
If the complainant has evidence confirming the circumstances indicated in the complaint (e.g. correspondence with the controller, contracts, certificates), he/she should attach them to the complaint. Since the President of the Office is the authority controlling the correct application of the provisions on the protection of personal data by the controller, the complainant should first address the controller in order to exercise his/her rights.
Object, before you lodge a complaint.
If the data controller does not know that you do not wish your data to be processed, the President of the Personal Data Protection Office might not be able to fulfil your request.
According to Art. 21 para. 2 and 3 of the GDPR, where personal data are processed for direct marketing purposes, the data subject shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.
Where the data subject objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
As foreseen in Art. 58 para. 2 letter c, the corrective power of the supervisory authority to order the controller or the processor to comply with the data subject's requests to exercise his or her rights, requires the data subject to approach the controller/processor with his/her request first.
IMPORTANT: The data subject has the right to request the controller to erase his/her personal data without delay.
According to Art. 17 para. 1 letter c of the GDPR, the controller shall have the obligation to erase personal data without undue delay where the data subject objects to the processing pursuant to Art. 21 para. 1 or Art. 21 para. 2 of the GDPR.
In reference to the objection as laid down in Art. 21 para. 1, the controller can be relieved from this obligation if it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
In the event where data subject, pursuant to Art. 21 para. 2 of the GDPR, objects to processing for direct marketing purposes, the personal data shall no longer be processed for such purposes.
A claim for compensation for violation of the provisions on the protection of personal data cannot be the subject of the proceedings before the President of the Office. This issue can only be settled before a common court.
The complainant cannot demand the imposition of an administrative fine on the controller in the proceedings initiated by his/her complaint. The decision on the imposition of an administrative fine lies solely within the competence of the President of the Office and is not implemented upon request.