Polish IP & IT law – copyright trademark computer internet telecomm » Inspector General for Personal Data Protection

Archive for: Inspector General for Personal Data Protection

Personal interests, case I C 327/11

August 30th, 2013, Tomasz Rychlicki

The case concerned class’ photos of 32 children. Such photos were placed on a social networking site naszaklasa.pl. The black and white pictures were taken between the years 1972-1980, in a public space, i.e. a public education institution. Most of them were photos of the class as a whole, not each individual student. One person who was shown in this picture demanded its removal. The administrator of a website refused. The case went through all stages of administrative proceedings, and the person concerned decided to initiate a civil suit. The plaintiff demanded an apology in the media, 20.000 PLN compensation and the payment of 50.000 PLN for a social purpose, from the owner of naszaklasa.pl

The District Court in Wrocław in its judgment of 10 May 2013 case file I C 327/11 dismissed the suit. The Court ruled that the person seeking for the protection of his or her image has to prove that such image was published and is recognizable. It results from identification of information features of an image. Moreover, the image should be recognized not only by the person concerned, but also by third parties. The image of the plaintiff contained in the pictures was not fully recognized even his colleagues from the former primary school, as evidenced by comments on the website. Publishing of any informational or shooting materials on the website only provides the opportunity to look at such meterial by others, but this does not mean automatically that such information reached to an unlimited number of people, and consequently, that information was widespread. The Supreme Court in its judgment of 10 February 2010 case file V CSK 269/09 (published in: OSNC 2010/9/127) held data published on the web are not deemed as well-known/widespread data. The Supreme Court in its judgment of 27 February 2003 case file IV CKN 1819/00 (published in: OSP 2004/6/75) held that the infringement of the image of the individual occurs when it was published without the consent of the person in the photograph and while it allows for the identification of that person.

Personal data protection, I CSK 190/12

August 29th, 2013, Tomasz Rychlicki

The Supreme Court in its judgment of 8 November 2012 case file I CSK 190/12 held that without a doubt, the first name and surname constitute personal data of the individual, therefore, the important question arose, whether they belong to the scope of the individual’s privacy as understood in the provisions of Article 5(2) of the Polish Act of 6 September 2001 on Access to Public Information – API – (in Polish: Ustawa o dostępie do informacji publicznej), published in Journal of Laws (Dziennik Ustaw) No. 112, item 1198, with subsequent amendments.

Article 5. 1. The right to public information is subject to limitation to the extent and on the principles defined in the provisions on the protection of confidential information and on the protection of other secrets being statutorily protected.
2. The right to public information is subject to limitation in relation to privacy of a natural person or the secret of an entrepreneur. The limitation does not relate to the information on persons performing public functions, being connected with performing these functions, including the conditions of entrusting and performing these functions and in the event when a natural person or entrepreneur resigns from the right to which he was entitled to.

Previous opinions of the Supreme Court on the relationship between the right to protect of personal data and the right to privacy are not clear. They were formulated mainly from the point of view of the protection of personal interests as defined in Articles 23 and 24 of the Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, published in Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments.

Article 23
The personal interests of a human being, in particular to health, dignity, freedom, freedom of conscience, surname or pseudonym, image, secrecy of correspondence, inviolability of home, and scientific, artistic, inventor’s and rationalizing achievements, shall be protected by civil law independent of protection envisaged in other provisions.

Article 24
§ 1 The person whose personal rights are threatened by someone else’s action, may require the desist of that action, unless it is not illegal. In the event of the infringement one may also require, the person who committed the violation, to fulfill the actions necessary to remove its effects, in particular, to make a statement of the relevant content and appropriate format. According to the conditions laid down in the Code one may also require monetary compensation or payment of an appropriate amount of money for a social purpose indicated.
§ 2 If as the result of a breach of personal rights one has suffered pecuniary prejudice, the aggrieved person may claim compensation based on general principles.
§ 3 The above shall not prejudice the entitlements provided by other regulations, in particular in copyright law and the patent (invention) law.

The Supreme Court in its judgment of 15 February 2008 case file I CSK 358/07 (published in OSNC 2009, no. 4, item 63) ruled that legal commentators and case law of the Constitutional Court agree that the right to protect of personal data is derived directly from personal rights such as human dignity and the right to privacy, citing judgments of the Polish Constitutional Tribunal of 19 February 2002 case file U 3/01 (published in OTK-A 2002, no. 1, item 3) and of 12 November 2002 case file SK 40/01 (published in OTK-A 2002, no. 6, item 81). Nowadays, the collection and processing of the personal data is technically relatively simple, therefore it is necessary to protect a person against uncontrolled collection and use of his or her personal data, often without the contribution or even awareness of the person concerned. For these reasons, the legislator specifically regulated the issues of data collection, processing, use and protection of personal data in the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of 29 October 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments. While interpreting its provisions, one cannot ignore the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and its preamble that explicitly states that data-processing systems are designed to serve man, whereas they must, whatever the nationality or residence of natural persons, respect their fundamental rights and freedoms, notably the right to privacy. The Supreme Court in its judgment of 28 April 2004 III CK 442/02 (unpublished) stressed that when assessing whether there has been the breach of privacy protected by the law, this concept cannot be absolutized due to the degree of its generality, it requires interpretation, taking into account the specific circumstances of the situation. Events and circumstances that form the personal and family life can be classified as private sphere of life. The special nature of this area of man’s life justify the grant of its strong legal protection. However, this does not mean that any reference to a particular person was information in the field of his or her personal life. The regime of protection of privacy and personal data protection regime are therefore independent. Undoubtedly, when it comes to the relationships and the impact of these regimes, because in certain situations, the actual processing of personal data may result in a violation of personal interests in the form of the right to privacy, or protection of the right to privacy will required the objection to the use of personal data. It is difficult to unequivocally determine whether the disclosure of the first name and the surname of an individual by a local government violates his or her right to privacy. This problem can be resolved only while assessing particular circumstances of each case. In this case, the city was requested to disclose the names of individuals with whom it has entered into a contract of mandate and contract of work. One of these contracts concerned preparation and delivery of a lecture. It was difficult for the Court to accept that anonymization and hiding of the surname of a person giving such a lecture would have any meaning. Other agreements related to use of the electronic system of sociological analysis and organization of the conference. They were entered by specific individuals with a public body, which was the city. These people had to reckon with the fact that their personal data will not remain anonymous. For a person requesting access to public information related contracts entered by a local authority, names of parties to such agreements are often more important than the content, and it is understandable for obvious reasons. It would be difficult in this case to defend the view that the disclosure of names of people in the present context would be deemed as a limitation on the exercise of constitutional freedoms and rights of these persons. It had therefore to be assumed, that the disclosure of the names of persons entering civil contracts with a local authority does not affect the right to privacy of those persons referred to in Article 5(2) of the API.

Personal data protection, case I OSK 1666/12

August 26th, 2013, Tomasz Rychlicki

The Polish company Promedica Care Sp. z o.o requested the Inspector General for Personal Data Protection (GIODO) to issue a decision that would order Agora S.A., the owner of gazeta.pl website, to disclose IP addresses of users who posted negative comments regarding Promedica24.pl website. The GIODO decided that Agora S.A. should disclose requested information, although, it also noticed that the provisions of Article 29 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, were repealed as of 7 March 2011.

1. The processing of data is permitted only if:
1) the data subject has given his/her consent, unless the processing consists in erasure of personal data,
2) processing is necessary for the purpose of exercise of rights and duties resulting from a legal provision,
3) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract,
4) processing is necessary for the performance of tasks provided for by law and carried out in the public interest,
5) processing is necessary for the purpose of the legitimate interests pursued by the controllers or data recipients, provided that the processing does not violate the rights and freedoms of the data subject.

However, these regulations should be still applied to proceedings initiated before the entry into force of the Act that repealed the above mentioned provisions, and there was no obstacle to justify the refusal to provide the requested data according to the provisions of Article 30 of the PPD.

Article 30
The controller shall refuse the access to the personal data of the filing system to subjects and persons other than those referred to in Article 29 paragraph 1, if it would:
1) result in the disclosure of the information constituting a state secrecy,
2) pose a threat to national defence or security of the state, human life and health, or security and public order,
3) pose a threat to fundamental economic or financial interests of the state,
4) result in a substantial breach of personal interests of the data subjects or other persons.

The General Inspector did not agree with Agora S.A. that providing the requested data would infringe personal interests of the users of gazeta.pl website and its fora. The violation was only hypothetical, and was not supported by proper evidence. Agora S.A. argued that there are no legal instruments that would allow for monitoring the use of disclosed data, and this may lead to their use not only inconsistent with the purpose for which they were disclosed, but even to such use that is contrary to law. The GIODO noted that the absence of such instruments is not synonymous with the use of disclosed data contrary to the purpose for which it was made available. At the moment such data was disclosed, the Company will become the controller (administrator) as defined in the Article 7(4) of the PPD.

Article 7
Whenever in this Act a reference is made to any of the following, it shall mean:
4) controller – shall mean a body, an organisational unit, an establishment or a person referred to in Article 3, who decides on the purposes and means of the processing of personal data.

According to the GIODO, the processing of these data will be subject to the regulations provided in the provisions of the PPD, in particular the obligation not to undergo further processing of the data collected that would not be in accordance with the objectives of the disclosure (so-called principle of expediency/purposefulness), and the control of data processing in compliance with the provisions on personal data protection will be still the competence of the Inspector General. Agora S.A. argued that the provisions of Article 18 of the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments, should be applied in its case, not the provisions of the PPD.

Article 18
1. The service provider may process the following personal data of the service recipient necessary for entering in, designing contents, amending or terminating legal relationship between them:
1) service recipient’s surname and names ,
2) his/her PESEL number (Personal Identification Number),
3) his/her permanent residence address,
4) his/her address for correspondence, if it is different than the address referred to in point 3,
5) data used for verifying the service recipient’s electronic signature ,
6) service recipient’s electronic addresses .
2. In order to effect contracts or other legal activity having been concluded with a service recipient, a service provider may process other data necessary due to nature (characteristics) of the service provided or way of its billing.
3. The service provider distinguishes and marks those data from among the data referred to in paragraph 2, as such being necessary for providing services by electronic means in accordance with art. 22 paragraph 1.
4. The service provider may process, upon consent of s service recipient and for the purposes set forth in art. 19 paragraph 2 point 2, other data concerning the service recipient, which are not necessary for providing service by electronic means.
5. The service provider may process the following data describing the way of using the service provided by electronic means by a service recipient (traffic data):
1) denotations identifying the service recipient assigned on the basis of the data referred to in paragraph 1,
2) denotations identifying the telecommunication network terminal or a teleinformation system, which have been used by a service recipient,
3) information about commencement, termination and a range of every usage of the service provided by electronic means,
4) information about using of the service provided by electronic means by a service recipient.
6. The service provider provides the information on data referred to in paragraphs 1 – 5 to the state authorities for the needs of legal proceedings carried on by them.

The provider is therefore obliged to provide information on all categories of data listed in Article 18(1-5) of the PSEM, to the State authorities for the purpose of the proceedings conducted by them. The Inspector General noted that the disclosed information should also be understood as such data. The GIODO said that the provision of Article 18(6) of the PSEM are constructed in general terms and do not indicate either the types of bodies that may request such information, or the types of proceedings: criminal, civil, administrative or enforcement. The Inspector General noted that the provision of Article 18(6) of the PSEM only requires the provider to disclose information to State bodies, and it should not be interpreted broadly as the legal norm that is prohibiting the disclosure of such information to other entities. The GIODO decided that if the legislature had the intention to limit the disclosure of the information referred to in Article 18(1-5) of the PSEM, only for the bodies referred to in Article18(6) of the Act, it would explicitly formulate this provision, for example, by using the phrase “only”, which is a legislative method of defining the closed circle of entities, as it was provided in other regulations, for instance in the Article 66g and Article 66j § 4 of the Polish Act of 17 June 1966 on Administrative Enforcement Proceedings, or in the Article 72(1) of the Polish Act 5 August 2010 on Protection of Classified Information and in Article 105(1) of the Polish Act of 29 August 1997 Banking Law. The Inspector General noted that the legislature did not use the phrase “only” in the provisions of Article 218 of the Criminal Proceedings Code – CRPC – (in Polish: Kodeks Postępowania Karnego) of 6 June 1997, Journal of Laws (Dziennik Ustaw) No 89, item 555, with subsequent amendments, in relation to an obligation to disclose, at the request contained in the order, to the court or the prosecutor any mail and packages and the data referred to in Article 180c and 180d of the Polish Act of 16 July 2000 on Telecommunications Law – TLA – (in Polish: Prawo telekomunikacyjne), published in Journal of Laws (Dziennik Ustaw) No 171, item 1800 with subsequent amendments.

Article 180c
1. The obligation referred to in Article 180a (1) shall cover the data necessary to:
1) trace the network termination point, telecommunications terminal equipment, an end user:
a) originating the call,
b) called;
2) identify:
a) the date and time of a call and its duration,
b) the type of a call,
c) location of telecommunications terminal equipment.
2. The minister competent for communications in agreement with the minister competent for internal affairs, having regard to the type of telecommunications activities performed by operators of a public telecommunications network or providers of publicly available telecommunications services, data specified in paragraph 1, costs of data collection and retention as well as the need to avoid multiple retention and storage of the same data, shall specify, by means of an ordinance:
1) a detailed list of data referred to in paragraph 1;
2) types of public telecommunications network operators or providers of publicly available telecommunications services obliged to retain and store the data.

Article 180d
Telecommunications undertakings shall be obliged to provide conditions for access and retention as well as to make available at their own cost the data referred to in Article 159 (1) (1) and (3) to (5), in Article 161 and in Article 179 (9) related to the provided telecommunications service and processed by them to authorized entities, to the court and to the prosecutor, under the terms and observing the procedures specified in separate provisions.

The Inspector General stressed that the legislature has indicated that only the court or the prosecutor is allowed to open the correspondence, mail and data, or order for their opening.

Article 218
§ 1. Offices, institutions and entities operating in post and telecommunications fields, customs houses, and transportation institutions and companies, shall be obligated to surrender to the court or state prosecutor upon demand included in their order, any correspondence or transmissions significant to the pending proceedings. Only the court and a state prosecutor shall be entitled to inspect them or to order their inspection.

The Inspector General also stressed that the above-cited provisions of the CRPC should not be applied in this case, because Promedica Care Sp. z o.o is not the authority conducting the proceedings in a criminal case, and the disclosed personal data will be used by it to initiate civil, not criminal proceedings. The GIODO indicated that Promedica may follow the procedure provided for in Article 29 of the PPD, and civil proceedings under the Civil Proceedings Code – CPC (in Polish: Kodeks Postępowania Cywilnego) of 17 November 1964, published in Journal of Laws (Dziennik Ustaw) No. 43, item 296, with subsequent amendments, regardless of actions taken under the criminal proceedings. Agora S.A. filed a complaint.

The Voivodeship Administrative Court in Warsaw in its judgment of 8 March 2012 II SA/Wa 2821/11 repealed the contested decision, and held that according to the provisions of Article 18(6) of the PSEM, the only one empowered to obtain data collected by the service provider within the meaning of that Act, are the State bodies. The PSEM does not contain any other provision, which serve as the basis for disclosure of data to the entities other than state authorities. The court stated that if the legislature’s intention was to give permission to obtain operational data to entities other than state authorities, it would have included a clear regulation providing for such permission in the PSEM. Data protection is a general rule. The service provider may process personal and operational data only in the extent and on terms defined in the PSEM. Only in the absence of regulations provided in the PSEM such processing may be based on an appropriate application of the PPD. The disclosure of data to third parties – such as Promedica Care – is breaking of that protection and as an exception to the rule cannot be interpreted broadly. GIODO filed a cassation complaint.

The Supreme Administrative Court in its judgment of 21 August 2013 case file I OSK 1666/12 dismissed it. The SAC held that any company or individual has the right to request ISPs to disclose e-mail addresses and IP addresses that are associated with the offensive entries.

Personal data protection, case II SA/Wa 152/13

July 29th, 2013, Tomasz Rychlicki

Jerzy S. requested the Inspector General for Personal Data Protection (GIODO) to issue a decision that would order Agora S.A., the owner of gazeta.pl website, to disclose IP addresses of a user, who under the nickname Marco wrote negative and defamatory comments regarding a sport article, that Jerzy S. published on gazeta.pl. This way Jerzy S. wanted to know real the name of Marco, in order to sue him or her for the infringement of personal rights based on the provisions of the Polish Civil Code. Jerze S. requested Agora to disclose such information, but the Company refused and cited provisions of Article 18(6) of the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments.

Article 18
1. The service provider may process the following personal data of the service recipient necessary for entering in, designing contents, amending or terminating legal relationship between them:
1) service recipient’s surname and names ,
2) his/her PESEL number (Personal Identification Number),
3) his/her permanent residence address,
4) his/her address for correspondence, if it is different than the address referred to in point 3,
5) data used for verifying the service recipient’s electronic signature,
6) service recipient’s electronic addresses .
2. In order to effect contracts or other legal activity having been concluded with a service recipient, a service provider may process other data necessary due to nature (characteristics) of the service provided or way of its billing.
3. The service provider distinguishes and marks those data from among the data referred to in paragraph 2, as such being necessary for providing services by electronic means in accordance with art. 22 paragraph 1.
4. The service provider may process, upon consent of s service recipient and for the purposes set forth in art. 19 paragraph 2 point 2, other data concerning the service recipient, which are not necessary for providing service by electronic means.
5. The service provider may process the following data describing the way of using the service provided by electronic means by a service recipient (traffic data):
1) denotations identifying the service recipient assigned on the basis of the data referred to in paragraph 1,
2) denotations identifying the telecommunication network terminal or a teleinformation system, which have been used by a service recipient,
3) information about commencement, termination and a range of every usage of the service provided by electronic means,
4) information about using of the service provided by electronic means by a service recipient.
6. The service provider provides the information on data referred to in paragraphs 1 – 5 to the state authorities for the needs of legal proceedings carried on by them.

The Company argued that it is obliged to provide such information only to the state authorities. However, the GIODO ordered Agora to disclose requested IP addresses. The Voivodeship Administrative Court in Warsaw in its order of 20 February 2013 case file II SA/Wa 153/13 suspended execution of the contested decision. The GIODO filed complaint against this order, but the Supreme Administrative Court in its order of 23 April 2013 I OZ 269/13 dismissed it.

The Voivodeship Administrative Court in Warsaw in its judgment of 17 June 2013 case file II SA/Wa 153/13 dismissed the compliant filed by AGORA. The Court ruled that in this case the condition established in Article 25(1)(v) of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, was met.

Article 25
1. In case where the data have not been obtained from the data subject, the controller is obliged to provide the data subject, immediately after the recording of his/her personal data, with the following information:
1) the address of its seat and its full name, and in case the controller is a natural person about the address of his/her residence and his/her full name,
2) the purpose and the scope of data collection, and in particular, about the data recipients or categories of recipients,
3) the source of data,
4) the existence of the data subject’s right of access to his/her data and the right to rectify these data,
5) the powers resulting from Article 32 paragraph 1 point 7 and 8.

Article 32
1. The data subject has a right to control the processing of his/her personal data contained in the filing systems, and in particular he/she has the right to:
1) obtain extensive information on whether such system exists and to establish the controller’s identity, the address of its seat and its full name, and in case the controller is a natural person to obtain his/her address and his/her full name,
2) obtain information as to the purpose, scope, and the means of processing of the data contained in the system,
3) obtain information since when his/her personal data are being processed and communication to him/her in an intelligible form of the content of the data,
4) obtain information as to the source of his/her personal data, unless the controller is obliged to keep it confidential as a state, trade or professional secrecy,
5) obtain information about the means in which the data are disclosed, and in particular about the recipients or categories of recipients of the data,
5a) obtain information about the prerequisites of taking the decision referred to in Article 26a paragraph 2,
6) demand the data to be completed, updated, rectified, temporally or permanently suspended or erased, in case they are not complete, outdated, untrue or collected with the violation of the act, or in case they are no longer required for the purpose for which they have been collected,
7) make a justified demand in writing, in cases referred to in Article 23 paragraph 1 point 4 and 5, for the blocking of the processing of his/her data, due to his/her particular situation,
8) object to the processing of his/her personal data in cases referred to in Article 23 paragraph 1 point 4 and 5, should the controller intend to process the data for marketing purposes or to object to the transfer of the data to another controller,

Personal data protection, case I OZ 850/12

January 20th, 2013, Tomasz Rychlicki

The Inspector General for Personal Data Protection in its decisions of 1 April 2012 nos. DOLiS/DEC-318/12/23575, 23580, 23585 ordered a Polish company to disclose IP addresses of computers. This information was required in other proceedings. The company filed a complaint against this decision and requested the court to stay its execution.

The Voivodeship Administrative Court in Warsaw in its order of 14 August 2012 case file agreed and GIODO filed a complaint against it.

The Supreme Administrative Court in its order of 21 November 2012 case file I OZ 850/12 dismissed it.

Personal data protection, case I OSK 1827/11

August 29th, 2012, Tomasz Rychlicki

The Inspector General for Personal Data Protection (GIODO) in its decision of 24 September 2010, no. DIS/DEC-1134/38146/10 ordered the Polish company Info Veriti Polska Sp. z o.o. Obsługa Serwisu Internetowego Sp.J., the publisher of online database of Polish entrepreneurs, to inform the individuals whose data that were publicly available in sources such as Court’s Monitor and Economic Monitor and which have been collected and preserved by the Company, according to the information requirement referred to in Article 25(1) of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, within 3 months from the date on which this decision becomes final.

1. In case where the data have not been obtained from the data subject, the controller is obliged to provide the data subject, immediately after the recording of his/her personal data, with the following information:
1) the address of its seat and its full name, and in case the controller is a natural person about the address of his/her residence and his/her full name,
2) the purpose and the scope of data collection, and in particular, about the data recipients or categories of recipients,
3) the source of data,
4) the existence of the data subject’s right of access to his/her data and the right to rectify these data,
5) the powers resulting from Article 32 paragraph 1 point 7 and 8.

Furthermore, the GIODO ordered the Company to register the collection of personal data of customers (owners of e-mail addresses) within 30 days from the date on which the decision becomes final, to allow users of infoveriti.pl website to freely consent to the processing of their personal data for marketing purposes within 30 days from the date on which this decision becomes final, to create documentation establishing security policy and the intruction for management of IT system that used to process personal data, within 30 days from the date on which this decision becomes final, to grant the authorization to the processing of personal data to persons who are allowed to process personal data within 14 days from the date on which this decision becomes final, and to create a record of persons authorized to process personal data within 14 days from the date on which this decision becomes final. Info Veriti argued that the provisions of Article 25(1) of the PPO should not apply in its case because the provision of other law provides and allows for personal data collection without the need to notify the data subject. Such allowance happens in the case of laws that introduced a formal disclosure of public registers, that include records containing personal information. The formal disclosure of a registry means the right of everyone to access data in the register, without the need to show the legal or factual interest. Due to the widespread legitimacy in terms of access to recorded data, a person obtaining information from the register is not in any way identified during data acquisition. The Laws relating to public records and registers, also do not require explicit registration of the collected data, and there is no knowledge of the registration body of when and to whom the data were disclosed. Moreover, some registration authorities, on the basis of generally formulated principles of transparency, put the data from public records for public networks such as the Internet, which makes impossible to control access of who accessed such register. The GIODO noted that the PPD does not prohibit the creation of separate collections based on data from sources generally available, however, it does not mean that such collections are not subject to the provisions of the PPD. The Company receives data from the National Court Register in order to create a separate database, which uses for its own commercial purposes. In this way, Info Veriti Polska becomes the administrator of the collected data, therefore, as the controller, it is obliged to information requirements. The right of individuals to keep information regarding their situation and status in private, is constitutionally guaranteed, and may be restricted exclusively by laws that have the statutory rank (only Acts). The Act on the National Court Register (KRS) is just such an act. In this case, the record of a natural person entered to the KRS is publicly available, because such Register was created to ensure the transparency of the economic market in Poland. The persons referred to in the Act on the National Court Register, are therefore required to provide their data for inclusion in the register and they must also reckon with the disclosure. This does not mean, however, that they must agree to the use of their data for purposes other than the generally speaking, transparency of economic activity. However, the data controller that processes personal data should provide due care in order to protect the interests of the persons whose data were collected and in particular to ensure that the data were collected for specified and legitimate purposes and are not further processed in a way incompatible with those purposes. The GIODO also noted that the list of situations that allow for waive the requirement to provide information, referred to in 25(1) of the PPD has changed as a result of amendments to the Act that were made in 2004. The provision of Article 25(2) pt 2 that allowed to waive the abovementioned obligation in a situation where the data provided for collection are generally available, was repealed. For these reasons, it was obvious that the intention of the legislature was to require data controllers who collect data “generally available” to completing the duties arising out of the provision of Article 25(1) of the PPD.

The company filed a complaint to the Voivodeship Administrative Court in Warsaw against the decisions issued by the GIODO. Info Veriti requested the Court to decide on the invalidity, or their repeal, in addition, the Company has applied for stay of the execution of the contested decisions and the order to return the costs of proceedings. Infor Veirit claimed that the processed data is very limited, restricted to surname, the national identification number (PESEL), date of birth and functions performed in the entities disclosed in the KRS. Therefore, it is impossible to provide information to persons whose data are processed, because some of them have historical character. These are people who in the past served specific functions. The data administrator is not able to provide such individuals with the required information. The data controller does not process data allowing for direct contact with a person (e.g. home address), and sending information to the address of the entity (e.g. companies created according to the provisions of the Polish Code of Commercial Companies), which in the past served a given function, can not be considered for the execution of the decision. In order to comply with the decision, Info Veriti would need to gather additional categories of data to make contact and send the required information. However, such an obligation should clearly expressed in the decision, which has not happened. The Company has no legal basis for the acquisition of new categories of personal data. The deadline of three months that was ordered by the GIODO is unrealistic in order to collect the required contact data in relation to all of the data are included in the database. The Company noted that its database contains all the data entered in the National Court Register. The purpose of data entered in the National Court Register is closely related to business transactions, and the widespread availability of the registry should not be regarded as interference in the private sphere of the individual whose data is disclosed in the registry. There isn’t therefore a need to notify such persons regarding the process of collecting their personal data, as instruments of public-law on protection of personal data are treated as protection of the right to privacy. The person who serves or served in the bodies of commercial companies must accept that the data will be in an open public record to which access will have anyone interested in business. The purpose of transparency and certainty of economic activity, according to the legislator, prevails over the protection of the name, surname, date of birth and the PESEL number of the persons who performed specific functions in the bodies that were entered into the KRS. Info Veriti also disagreed with the opinion of the GIODO, which opposes the existence and goals of the KRS and data collection of the Company, the latter being also created in order to provide the transparency of economic activity. Services provided by the Company are based on data from public records and explicitly relate to economic activity of specific individuals. Such commercial processing of data previously collected by public entities is allowed by EU law, such as Directive 2003/98/EC of the European Parliament and of the Council of 17 November 2003 on the re-use of public sector information. Information on such entities contributes to the establishment of the internal market and creates a system ensuring undisturbed competition in that market. It is also emphasized that public sector information is an important starting material for products and services related to digital content, and more opportunities to re-use this information should allow European companies to use their potential and contribute to economic growth and job creation. As “information services” of Info Veriti are based on data obtained from public records, they fit into the goals provided in the recitals of the Directive 2003/98/EC. According to Infor Veirit, the consequences of the position taken in the decisions of the GIODO, which implies obligation to provide information to any person that collects data from the National Court Register, if there are situations referred to in Article 2 (1-2) of the PPD, are also unacceptable.

Article 2
1. The Act shall determine the principles of personal data processing and the rights of natural persons whose personal data is or can be processed as a part of a data filing system.
2. The Act shall apply to the processing of personal data in:
1) files, indexes, books, lists and other registers,
2) computer systems, also in case where data are processed outside from a data filing system.

Such requirement would have to be commonly executed in the course of trade in relation to a number of activities related to the acquisition of data from the National Court Register. Given the widespread use of copies of the KRS, that are used for instance to identify the persons authorized to represent the company at the conclusion of the contract, such an interpretation would lead to economic paralysis, and certainly also to the irrational (excessive) financial costs, in the name of privacy protection, which in the present case does not occur.

The Voivodeship Administrative Court in its judgment of 2 June 2011 case file II SA/Wa 720/11 dismissed the complaint. The Court held that the Polish legislator afforded the citizen’s right to privacy in Articles 47, 49 and 51 of the Constitution. This also includes the protection of personal data and privacy against excessive interference by others. The provision of Article 47 of the Constitution sets out the principle of the protection of private life, Article 49 provides for the protection of the correspondence, while the provision of Article 51 states that no one shall be obliged, except under the Act to disclose information concerning his person, a public authority may not acquire, collect and share information on citizens other than those necessary in a democratic state ruled by law, everyone has the right of access to official documents and it datasets. Limitation of this right may be established by statute (act), and to anyone has the right to request the correction or deletion of information incorrect, incomplete, or collected in a manner inconsistent with the Act. These regulations are expanded in the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, which in turn refers to the solutions contained in Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data. These instruments created a basic framework for data protection in the Republic of Poland. The PPD created statutory principle of the protection of personal data. In accordance with Article 1 of the PPD, any person has a right to have his/her personal data protected. The processing of personal data can be carried out in the public interest, the interest of the data subject, or the interest of any third party, within the scope and subject to the procedure provided for by the Act. The protection of personal data is a fundamental right of citizens in a democratic state of law. Protection of personal data is closely connected with the protection of private life and, therefore, it determines the freedom of the citizen. The right to protection of personal data, however, is not absolute and it is limited in the interests of the public or justified interests of others. However, since it is a citizen’s right, that determines a person’s sense of freedom, the exceptions allowing for the collection and use of personal data should be subject to strict interpretation. The legislature guided by the values of protection of constitutional rights cannot allow for a situation in which the law by the wider interpretation of the provisions relating to the processing of personal data, is violated. The provisions of the Act on the National Court Register lay down the rules of registration and the rules of disclosure of data. Such data are available electronically by the Central Information of the KRS or by viewing the register files in the appropriate departments of the Polish courts. These data are made available to any interested person, for the purposes of certainty of economic activity. The persons who undertakes an activity that is to be entered into the KRS, knows that the data is maintained by the State in the registry and data will be used only on the basis of the provisions relating to the functioning of the registry. Meanwhile, Info Veriti collects personal data and information disclosed in the register, such as surname, the PESEL number into its own database, in which data are processed. Data and information from the KRS are not intended for this purpose, and the people who share their personal information do not accept the fact that their personal data had been placed in another private database. When entrepreneurs decide to place their data into the KRS, they also have confidence that such data will be disclosed and used only in a manner permitted by the Act on the National Court Register. The legislature cannot allow for the situation that the protection of personal data contained in the KRS will not be limited to entities that wish to use the data for other purposes, and in a different way than permitted by the Act on the National Court Register. At this time, it would lead to a situation in which data from KRS could be used in an unrestricted way, against the will of the people entered into the register, for instance, in order to create a database for the marketing campaign. The court did not agree with the argument that the contested decision is contrary to the provisions of Directive 2003/98/EC. According to the court, the Directive does not apply directly to the Polish law, as EU directives are implemented into the law of a Member State and only then enter into force in the legal system. This Directive is not implemented to the Polish law, and Poland still works on the implementation. The court held that the contested decision is enforceable. Info Veriti builds its own database and has data that allow the Company to perform the information requirement to those who are in the database. It is possible because there are surnames and PESEL numbers of individuals, and businesses headquarters, where they perform given functions. Moreover, Info Veriti may use the services of the Central Bureau of Domiciliary. The fact that it is a big organizational task and it involves a large number of people does not mean that it is not feasible. By building a large database the Company had to be aware that in relation to the number of people it will have specific obligations according to the provisions of the PPD. Info Veriti filed a requested to stay the execution of the decisions.

The Supreme Administrative Court in its order of 30 September 2011 case file I OSK 1827/11 decided to stay the execution of both decisions.

Personal data protection, case IX Nc 1850/11

April 14th, 2012, Tomasz Rychlicki

The Regional Court in Wrocław in its judgment of 2 February 2012 case file IX Nc 1850/11 held that that there was no reason to accept the view that electronic services providers are required to bear costs for rendering information on given data to the state authorities for the needs of legal proceedings carried on by them. Therefore, the court ruled that the Police has to pay to the company that operates social-networking site for gathering and processing requested data and information, according to the specifiaction that was received from the Police.

Personal interest, case II SA/Wa 364/11

October 13th, 2011, Tomasz Rychlicki

On January 2010, a couple of entries signed by the nick “arfulik” appeared on few Polish websites. The author wrote critically about the company Bavaria Consulting and a person who is a member of the board. It seemed that this unknown author conducted a competitive activity. Bavaria and Krystiana D. decided to sue for the infringement of personal interest. They needed personal data of a person who wrote questioned comments. Telekomunikacja Polska (TP), one of the largest ISPs, refused to provide such information, referring to the telecommunications confidentiality included in the Article 159 of the Polish Act of 16 July 2000 on Telecommunications Law – TLA – (in Polish: Prawo telekomunikacyjne), published in Journal of Laws (Dziennik Ustaw) No 171, item 1800 with subsequent amendments. Allegedly slandered filed a complaint to the Inspector General for Personal Data Protection (GIODO). The GIODO ordered the disclosure the personal data but he overturned this decision after TP filed a request for reconsideration. The GIODO decided that such information is subject to the telecommunications confidentiality and found no reason to disclose it. The offended persons lodged a complaint against this decision.

The Voivodeship Administrative Court in its judgment of 7 October 2011 case file II SA/Wa 364/11 dismissed it, and ruled that the intention of bringing action against the author of a forum post or comment is not a sufficient condition to disclose personal data. One has to file a suit for protection of personal interest. Only then, a court in order to avoid procedural deficiency, will summon the telecommunications operator to disclose personal data of the author of the questioned post.

Personal data protection, case I OSK 1208/10

July 11th, 2011, Tomasz Rychlicki

Katarzyna S. had a website where she published information on breeding dogs. There was also another forum with such information. Grzegorz W. was a dog breeder and he noticed that his personal data and information on his breeding appeared on this websites. Some users posted also negative comments. Grzegorz W. requested the Inspector General for Personal Data Protection (GIODO) to issue an administrative decision ordering the removal of his personal data and all threads and posts connected with his name. He also requested the GIODO to check whether Katarzyna S. as a controller has registered the collection of personal data that was gathered during the operation of her website and the forum.

GIODO learned that the forum website was administered by another person who claimed that the questioned website had nothing to do with her professional activity, it was only a hobby. She never received any paid advertising, nor any funds from anyone. Moreover, she informed that the forum was removed from the net for several months. GIODO discontinued the proceedings. GIODO ruled that Katarzyna S. was not involved in the processing of personal data as a part of her business or professional activity. Jerzy W. filed a complaint against this decision.

The Voivodeship Administrative Court in its judgment of 14 April 2010 case file II SA/Wa 2130/09 ruled that dogs breeding may be directed to gain profits, because it can be associated with the sale of dogs. The Court decided that GIODO should reconsider the case. GIODO filed a cassation complaint.

The Supreme Administrative Court in its judgment of 28 June 2011 case file I OSK 1208/10 overturned the questioned judgment and sent the case back for reconsideration. The SAC ordered the VAC to examine whether the processing of personal data on the internet website had something to do with breeding activities.

Personal interest, case I OSK 1217/10

July 4th, 2011, Tomasz Rychlicki

The Inspector General for Personal Data Protection (GIODO) ordered Axel Springer Polska to disclose addresses of three authors who wrote a critical article in “Dziennik” newspaper about Polish businessman, however, information presented in the article proved to be incorrect. He wanted to sue all authors but Axel Springer refused to provide addresses, therefore, the lack of addresses of the defendants in the lawsuit was the reason for the civil court to dismiss the action.

Axel Springer Polska filed a complaint against the decision of the GIODO but the Voivodeship Administrtive Court in its judgment of 8 April 2010 case file II SA/Wa 1488/09 dismissed it. Axel Springer filed a cassation complaint.

The Supreme Administrative Court in its judgment of 18 June 2011 case file I OSK 1217/10 ruled that if the addresses of journalists are required to bring an action for the protection of personal interest, the publisher must disclose them to the requesting party.

Personal data protection, case II SA/Wa 2037/10

May 12th, 2011, Tomasz Rychlicki

The Polish branch of McDonald’s Corp. has made a promotional campaign based on the issuance of the so-called “bonificards” i.e. discount cards entitling the holder to purchase certain McDonald’s products at a reduced price. Only employees and business partners were allowed to use such cards. The terms of the promotion explicitly stated that the cards cannot be resold. McDonald’s learned that cards were offered for sale or as a free bonus to other items sold on Allegro – Polish Internet auctions website.

McDonald’s requested Allegro to disclose personal data of persons engaged in the above mentioned auctions, on the grounds that these buyers and sellers violated the terms and rules of promotion, and thus McDonald’s intended to take steps to – on one hand – to deprive sellers of their wrongfully obtained benefits, on the other hand – to take away all bonificards from people who bought them. Allegro refused to provide requested data, indicating that there was no reason to assume that there was any kind of illegal action, arguing that disclosure may be classified as unlawful conduct of the controller that violates personal interests of the users and that may result in Allegro’s responsibility that is based on civil law regulations.

McDonald’s requested the Inspector General for Personal Data Protection to order Allegro the disclosure of information previously requested. The GIODO refused and pointed out that in this case the interests of McDonald’s cannot prevail over the interests of persons affected by the request. The disclosure of such data would be, in fact, too far-reaching interference with the privacy of the person concerned. McDonald’s filed a complaint against these decisions.

The Voivodeship Administrative Court in Warsaw in its judgment of 16 March 2011 case file II SA/Wa 2037/10 overruled GIODO’s decisions. The VAC held that McDonald’s has the right to know who offers promotion cards at online auctions provided by Allegro. The Court ruled that the provisions of the PPD cannot be interpreted as meaning that the disclosure of personal data of a person who offer to sell someone else’s property, violates that person’s interests. The protection of interests of one person cannot be done without prejudice to the rights of others. Especially, when such persons knew that they were trying to dispose of someone’s else things whose value was measured in money (the value of the Company’s products that were available in the promotional terms). The court ordered to reconsider the case, where the GIODO shall take into account all comments made by the VAC. The GIODO decided to file a cassation complaint.

The Supreme Administrative Court in its judgments case files I OSK 834/11 and I OSK 1137/11 agreed with the GIODO. The Court held that in the case of electronic services, personal data may be disclosed only for the purposes of criminal proceedings.

Personal data protection, case II SA/Wa 1212/10

February 4th, 2011, Tomasz Rychlicki

The case of Tomasz W. and his image treated as personal data still continues. See “Personal data protection, case I OSK 667/09“. GIODO annulled its earlier decision, however it also refused to take account Tomasz W. requests in its new decision. GIODO ruled that personal data (photos and captions) of Tomasz W. are not presented on the website, and are not publicly available because they were removed from the specified address. GIODO also noted that Nasza-Klasa is still processing the personal data treating it as evidence, because it keeps them on its servers and in the system’s memory. GIODO finally held that the Company, as controller, is processing these data under provisions of Article 23(1)(v) of the PPD, under which such the processing of data is permitted because it is necessary for the purpose of the legitimate interests pursued by the controller and that the processing does not violate the rights and freedoms of the data subject. Among the reasons justifying the data processing, GIODO mentioned the possibility of establishing the responsibility of the recipient for violations of the Terms of Service that were set by the Company. This judgment is not final yet. GIODO filed a cassation complaint.

The Voivodeship Administrative Court in Warsaw in its judgment of 1 December 2010 case file II SA/Wa 1212/10 ruled that, these circumstances do not fulfill the conditions for legitimate interests of data processing. It should be noted that the condition relates to the existing and unquestionable situation, so if there is a need to demonstrate a need to claim in business, not a situation where the data are processed for eventual trial and the possible need to prove that personal data obtained without the consent of the person concerned shall be processed in accordance with the law. The Court also noted that Tomasz W. only announced but he did not initiate any courts proceedings against Nasza-Klasa. Therefore, according to the Court, Nasza-Klasa was not allowed to process personal data only to protect itself against any future and uncertain claims mentioned by Tomasz W. Otherwise, there are doubts how long to process personal data if Tomasz W. fails to comply with his announcement.

Personal data protection, case DOLiS/DEC-1013/10 concerning DOLiS-440-276/10

September 27th, 2010, Tomasz Rychlicki

The Inspector General for Personal Data Protection (GIODO) in its decision of 13 September 2010 case file DOLiS/DEC-1013/10 concerning DOLiS-440-276/10 ruled that according to the wording of Article 18(1) pt 2 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, in the event of the breach of provisions on personal data protection, the GIODO ex officio or at the request of the person concerned, by an administrative decision, shall order the restoration of the situation in accordance with the law and, in particular, to complete, update correct, disclose or not to disclose of personal data.

Article 18
1. In case of any breach of the provisions on personal data protection, the Inspector General ex officio or upon a motion of a person concerned, by means of an administrative decision, shall order to restore the proper legal state, and in particular:
1) to remedy the negligence,
2) to complete, update, correct, disclose, or not to disclose personal data,
3) to apply additional measures protecting the collected personal data,
4) to suspend the flow of personal data to a third country,
5) to safeguard the data or to transfer them to other subjects,
6) to erase the personal data.
2. The Inspector General’s decisions referred

Given the circumstances of the case, the GIODO considered that he is authorized – by the established rules – to order the Company to disclose to the applicant information about a person who, on in 2010, at 20:29 had registered on www.gowork.pl web portal using the nickname “anonymous”, i.e. information about IP address of a computer used to post the questioned entry.

Personal interest, case I C 144/10

August 15th, 2010, Tomasz Rychlicki

A Polish citizen filed a civil suit against Nasza Klasa company – the owner and operator of social networking website. He seek an apology and a payment for the infringement of his personal interest by the fact that Nasza Klasa refused to provide the plaintiff with personal data of the person who set up a fake profile, and allowed for the creation of such a profile, which was finally closed after several unsuccessful requests.

The Inspector General for Personal Data Protection in its decision of 5 March 2010 ordered Nasza Klasa to provide the plaintiff with information (full name, address, e-mail and IP address of a computer) of the person who set up the profile of the YYY number on nasza-klasa.pl website, ordering at the same time, to fulfill the obligation referred to in Article 33(1) of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments.

Article 33
1. At the request of the data subject, within the period of 30 days, the controller shall be obliged to notify the data subject about his/her rights, and provide him/her with the information referred to in Article 32 paragraph 1 point 1-5a as regards his/her personal data, and in particular specify in an intelligible form:
1) the category of personal data contained in the file,
2) the means of data collection,
3) the purpose and the scope of data processing,
4) the recipients of the data and the scope of access they have been granted.

While executing this decision Nasza Klasa informed the plaintiff that the fictional profile was set up on behalf of a person of a first name “s d.”, the second name “w. I’m gay”, having e-mail address xyz@wp.pl. At the same time the company informed the plaintiff that it has no data with regard to IP addresses from which the profiles are set on its website, these data are not collected, and kept or archived. However, as it was also clear from the order of the District Court in Poznań of 16 June 2010 on an ongoing parallel criminal proceedings that Nasza Klasa provided the Police with the IP number, host and e-mail address of the person who has registered this fictitious profile containing personal information of the plaintiff.

The District Court in Wrocław in its judgment of 23 July 2010 case file I C 144/10 ruled that the way that Nasza Klasa has executed the decision bears hallmarks of malignancy, where the repetition of the contents of the fake profile certainly violated the plaintiff’s dignity. The Court noted also that the activity of Nasza Klasa which allows its users for the opening of online accounts, including fictitious accounts does not have the characteristics of illegality. Therefore, the plaintiff was not allowed to infer the responsibility of Nasza Klasa, because during the use of legal mechanisms, there was an infringement of his personal interests. In other words, the illegal nature has only the act of the direct infringer – an unknown person who registered fictional profile on nasza-klasa.pl website, that was containing personal information of the plaintiff, including his image, in the context of information insulting him.

The mere creation of a registration/login mechanism within defendant’ hosting services, without any specific negligence in the performance of duties imposed by law cannot justify the defendant’s liability for the infringement of personal rights of the plaintiff. According to the Court such reasoning would justify shifting the liability of the direct offender of personal right to the hosting service provider.

The Court held that Nasza Klasa committed a violation of personal rights by refusing to grant the plaintiff an access to personal data of the person who set up a fake profile infringing on his personal interest and being opprobrious to his identity, despite the fact that the plaintiff was entitled to obtain it, which was confirmed by final decision of the GIODO. The Court ruled that Nasza Klasa company as a professional hosting provider, which created and maintains a social networking website – in accordance with its TOS – should be aware of how the decision of Inspector General for Personal Data Protection should be executed. Moreover, Nasza-Klasa was aware of the circumstances of the plaintiff’s case, which lasted almost a year. At that time, the plaintiff has shown a determination to assert his rights, despite the fact that without a personal data of the offender, has repeatedly been put in a kind of a hopeless situation, not only by law enforcement, but also by Nasza-Klasa company. Since Nasza-Klasa did not have the name of the person who registered the fictitious profile with the data of the plaintiff, it shall inform the plaintiff and explain the problem and execute the decision of the GIODO with regard to available data (IP, e-mail address of the perpetrator). Nasza Klasa decided to file an appeal complaint. The Appelatte Court in Wrocław in its judgment of 18 Nobember 2010 case file I ACa 1129/10 reversed the previous judgment and dismissed the suit.

Who is the controller in social networking sites?

February 14th, 2010, Tomasz Rychlicki

The question of who is the “controller” and the differences between a “controller” and “processor” as defined in the article 2(d) and (e) of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, in the context of social networking sites (SNS), are at least controversial not only in Polish case law. See for instance T. Zeggane, W. Maxwell, US and EU Authorities Review Privacy Threats On Social Networking Sites, Ent. L.R. 2008, 19(4), 69-74.

The second area requiring clarification is the concept of “data controller” in an SNS environment. Under European privacy law, the controller is the entity which determines the purposes and means of the processing of personal data. In an SNS context, there are two broad categories of data: the information that the user provides to the SNS platform to register (such as the user’s real name and email address), and the data that the user uploads onto his or her profile. The former is personal data which the SNS platform controls. The latter is “user generated content”, which the user controls and can choose to share (or not) with others. Some SNS platforms provide the user with tools to control the extent to which information such as photos, personal tastes and the like are used to develop targeted advertising. Where such tools exist, the argument can be made that the user (and not the SNS platform itself) is the “controller” of the content the user uploads onto the profile. The concept of data controller is the cornerstone of European privacy law. The concept of controller as it is traditionally interpreted does not fit easily into the SNS environment, where the user is the focal point

As you can read from the above, the authors suggest that the situation requires a clarification of the concept of “controller” in terms of SNS. A similar view was also presented in the report of the European Network and Information Security Agency (ENISA), “Security Issues and Recommendations for Online Social Networks“, PDF file, p. 25.

Personal data protection, case I OSK 667/09

February 13th, 2010, Tomasz Rychlicki

On 15 January 2008, Tomasz W. filed with the General Inspector for Personal Data Protection (GIODO) a complaint concerning an unauthorized processing of personal data carried out by the Polish company Nasza Klasa Sp. z o.o. from Wroclaw, the owner of nasza-klasa.pl website. He informed the GIODO, that this very popular Polish website on classmates, hosts a photo featuring his image together with a list of names of other photographed people attached to it. Tomasz W. has repeatedly appealed to the website administrators with the request to remove his name from the list. However, he received no response from Nasza Klasa company.

As a result of the investigation, the GIODO found that on 31 December 2007, a registered user of nasza-klasa.pl posted classmates’ photo featuring students of a primary school. On the same day, another registered user, placed the names of people who were portrayed at the photograph – including the name and surname of Tomasz W. On 2, 9 and 14 January 2008, Tomasz W. requested Nasza Klasa Sp. z o.o. the removal of his personal data.

In a decision of 27 May 2008, case file DOLiS/DEC-314/08/13239, the GIODO, relying on the provisions of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of 29 October 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, ruled that information on the applicant’s full name, school and class to which he attended, together with his image, are personal data and the data collector is Nasza Klasa Sp. z o.o.

However, the GIODO also ruled that it should be borne in mind that according to the provision of the Polish Act of 18 July 2002 on Providing Services by Electronic Means – PSEM – (in Polish: ustwa o świadczeniu usług droga elektroniczną), published in Journal of Laws (Dziennik Ustaw) No. 144, item. 1204 with subsequent amendments, Nasza Klasa sp. z o.o. provides electronic services for registered users of the portal website, consisting of the storage of data of these users in the computer system. This activity is the condition to legalize the processing of personal data in accordance with article 23(1) pt. 5 of the PPD. In addition, the GIODO found that in this case the applicant’s rights have not been violated, because the access to its data was limited to a group of people registered on nasza-klasa.pl website.

Tomasz W. asked the GIODO for the retrial. He pointed out that the reasons for the decision have many contradictions, inconsistencies and is ambiguous. He accused the GIODO of laconic and cursory treatment of his case. He again emphasized that his personal data have been published on the nasza-klasa.pl website without his knowledge or consent, in violation of his civil rights and liberties.

After the rehearing of the case, the GIODO annulled the contested decision, and discontinued the proceedings. GIODO claimed that the re-examination of the case leads to the conclusion that the disputed information about Tomasy W. did not fall within the definition of personal data. The name and surname have been given under his old image from many years ago. Hence, the combination of photos from the past, with a name and surname of a person and a primary school, which such person attended did not allow for the identification of a person without excessive costs and time. The findings that the disputed information is not personal data within the meaning of the PPD caused the proceedings in the matter to be groundless and on the basis of article 105 § 1 of the APC, it had to be discontinued.

Tomasz W. lodged a complaint with the Viovodeship Administrative Court in Warsaw. The complainant asked for annulment of the decision of first and second instance. Tomasz W. claimed the violation of the substantive law, i.e. article 6(1) of the PPD, through its improper interpretation, of article 32(1) pt 7 and 8 of that Act, by recognizing that Tomasz W. is not entitled to request cessation of the processing of his data and the right to object, and a breach of article 7 of the APC by not explaining all the relvant facts. Tomasz W. disagreed with the statement of the GIODO that questioned information about his person is not personal data within the meaning of the PPD. He stated that any information about an identified or identifiable individual is personal data. Furthermore, he argued that the claim of the GIODO that the data are available only for specific people – registered users of the portal is not acceptable, because nasza-klasa.pl has no mechanisms for verification of users identity, which makes the questioned data easily accessible for everyone. Moreover, Tomasz W. also argued that a registered user who does not know him would have some difficulty in identifying his person but such obstacles would not happen to a person who knows about Tomasy W., and is looking for additional information.

The Voivodeship Administrative Court in its judgment of 3 March 2009 case file II SA/Wa 1495/08 ruled that the GIODO erred in its decisions, because information about the name and surname of Tomasz W., combined with information about the name and address of the primary school and the determination of the class to which he attended in 1978/79, even if it was thirty years ago, are personal data. According to the Court provisions of article 1 of the PPD introduced the principle of autonomy of human information, meaning the protection of information about human being. This provision is a kind of emanation of the general right guaranteed by the Polish Constitution in article 47, according to which “Everyone shall have the right to legal protection of his private and family life, of his honour and good reputation and to make decisions about his personal life”. This means that the protection of personal data is related to the protection of privacy rights. This follows from the wording of article 6 of the PPD, indicating that the personal data concern identified or identifiable natural or legal person and that the identifiable is a person is one whose identity can be determined. From wording of that provisions the VAC concluded that personal data are data that identify a person’s identity. The VAC also relied on the content of recital 12 of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, which emphasized the protection of all data relating to a person, and therefore also information about someones past.

(12) Whereas the protection principles must apply to all processing of personal data by any person whose activities are governed by Community law; whereas there should be excluded the processing of data carried out by a natural person in the exercise of activities which are exclusively personal or domestic, such as correspondence and the holding of records of addresses

However, in recital 26 of the abovementioned Directive states that data protection rules must apply to any information concerning an identified or identifiable person. In order to determine whether a person is identifiable, all the means which can be used by the controller or any other person to identify a person, should be taken into the account. The rules of data protection do not apply to data rendered anonymously in such a way that a subject of the data can not be identified. The identification of a given person concerns also past information about a specific human being, by which information one can learn about such person’s identity. Accordingly, the VAC held that European law means the protection of personal data as the protection of all the facts concerning the past of a particular person, which corresponds with the content of article 6(2) of the PDP. So this means that such data would also be protected. Referring to the foregoing facts of Tomasz W. case, the VAC ruled that that nasza-klasa.pl website published his image and name. In the opinion of the court these are the personal data which are protected by the PPD, because on their basis one is able to identify given person.

Nasza Klasa sp. z o.o. filed a cassation complaint with the Supreme Administrative Court (SAC) challenging in entirety the judgment of the VAC. The Supreme Administrative Court in a judgment of 18 November 2009, case file I OSK 667/09, rejected the complaint. The SAC held that the primary issue arising in this case was whether a classmates’ picture that was taken thirty years ago, at which Tomasz W. is potrayed, in the circumstances of the case, can be analyzed to determine his identity without necessarily involving excessive resources or time, and therefore, whether the data disclosed in the photo in question, constitutes personal data within the meaning of article 6 of the PPD, and whether it should be protected.

The concept of “personal data” on the Polish law includes any information concerning an individual if it is possible to define its identity and its identification. Personal data is a set of messages about a particular person such integrated that it allows for its individualization. It includes at least information necessary for identification (name, surname, place of residence), but this is not restricted, because it also include further information, strengthening the degree of identification. Such information will also include pictures of the individual, even if they were taken in the past, allowing to identify a person. In a situation where such a photograph is presented with a name and surname of the person portrayed, in a place accessible to an unlimited number of entities, it must be considered that it constitutes personal data subject to protection under the PPD. Mainly, the objective evaluation criteria decides for the qualification of given information as personal data, but it also should comprise of all information, including extralinguistic (context), to which third party may have or has an access. A different approach to the presented issues would maginalize the importance of the laws and it would not relate to its designated function.

Thus it should be considered that the image of Tomasz W. portrayed at the photograph that was taken 30 years ago, affixed with the class, his name and surname, and then published at nasz-klasa.pl website constitutes personal data within the meaning of article 6(2) of the PPD, and the cassation complaint was not justified. The SAC also noted that the consent for the processing of personal data cannot be in any way implied.

The SAC also stressed the fact the Internet as a source of information is increasing on a unknown scale and importance. It provides an access to specific information to a vast number of persons and allows for any of its processing within the meaning of the PPD. At the same time there are not yet developed appropriate mechanisms for the protection of individual rights when those rights have been violated as a result of the disclosure of information on the Internet. Then, it is a great role of law enforcement bodies, including the Inspector General for Personal Data Protection in creating practice to comply with applicable laws also on the Internet. It is an unacceptablr situation in which the entity seeks to remove its image from a particular website, and the administration fails to take action to ensure the protection of civil rights. The image is one of the very personal property rights and lack of consent to its publication, if it is not a public person, is a sufficient reason to believe that regulations of the PPD apply, if the conditions set in the article 6(2) of the PPD have been met. There is a legal sequel to this story. See “Personal data protection, case II SA/Wa 1212/10“.

Personal data protection, case II SA/Wa 71/07

February 12th, 2010, Tomasz Rychlicki

A lawyer representing one Polish entrepreneur, and as you already know personal data of the parties are removed from Polish courts’ judgments, requested the General Inspector for Personal Data Protection (GIODO) to issue an order to Home.pl company from Szczecin, to disclose personal data such as name, surname, the firm, address, office’s seat, phone number and e-mail address of a person, which had only published its caller id, and who registered a certain Internet domain name. The lawyer stated that his client is claiming the right to use the questioned domain name and the requested information is necessary for the initation of the arbitration proceedings before the Court of Conciliation at the the Polish Chamber of Information Technology and Telecommunications.

Home.pl refused to provide the abovementioned personal data, arguing that the parties of the legal relationship arising from the fact of the registration and maintenance of Internet domain names are the Research and Academic Computer Network (in Polish: Naukowa i Akademicka Sieć Komputerowa) – the national registry of the .pl domain, and the domain name subscriber.

The GIODO performed an investigation based on the administrative proceedings regulations. The GIODO did an inspection of the Company’s headquarters and found that Home.pl maintains a separate collection of data of subscribers who have registered their domain names in NASK through Home.pl services. NASK is the national domain name registrar, while Home.pl arranges for the registration and maintenance of Internet domain names. Home.pl represents an applicant for the domain name registration before NASK. A natural or legal person and Home.pl have to establish a legal relationship based on a registration contract in order to register the domain name in NASK. The legal relationship is based on registering and maintaining of the internet domain name. The GIODO found that in this case, the contested domain name was registered by a natural person.

In September 2006, the General Inspector for Personal Data Protection issued an administrative decision which ordered Home.pl to disclose personal data of the individual who registered the Internet domain name in question, the name, surname, address, phone number and e-mail address. Home.pl requested for a retrial of the case. The GIODO upheld the decision and Home.pl filed a complaint against it.

The Voivodeship Administrative Court (VAC) in Warsaw in its judgment of 30 Novmeber 2007 case file II SA/Wa 71/07 ruled that the complaint was based on Article 29(2) in connection with Article 22 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of 29 October 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments.

Article 29
1. In case of providing the access to the data for the purposes other than including into the data filing system, the controller shall disclose the data kept in the data filing system to persons or subjects authorised by the law.
2. Personal data, exclusive of data referred to in Article 27 paragraph 1, may also be disclosed, for the purposes other than including into the data filing system, to persons and subjects other than those referred to in paragraph 1 above, provided that such persons or subjects present reliably their reasons for being granted the access to the data and that granting such access will not violate the rights and freedoms of the data subjects.
3. Personal data are disclosed at written and justified requests, unless the provisions of another law state otherwise. Such requests should include information allowing for identification of the requested personal data within the filing system and indicating their scope and purpose.
4. Disclosed personal data shall be used only pursuant to the purpose for which they have been disclosed.
(…)
Article 22
The proceedings with respect to the matters regulated by this Act shall be conducted pursuant to the provisions of the Code of Administrative Procedure, unless other provisions of the law state otherwise.

According to the VAC, the provisions of Article 29(1) and (2) allow third parties to request the disclosure of personal data for purposes other than inclusion in the collection. It should be noted that these provisions being in force until 1 May 2004, gave no grounds to demand the disclosure if the controller was the private sector. This situation changed after the amendment of 22 January 2004. The Court noted that the request for disclosure of personal data may be filed by any person i.e. natural person, any organizational unit, both public and private. It is important that the possesion of personal data is necessary to achieve intended goals, and the request for personal data is credible and reasonable. Such request does not require a collector to disclosure personal data because it must assess whether the conditions have been met to provide such data according to provisions of Article 29 of the PPD.

1. In case of providing the access to the data for the purposes other than including into the data filing system, the controller shall disclose the data kept in the data filing system to persons or subjects authorised by the law.
2. Personal data, exclusive of data referred to in Article 27 paragraph 1, may also be disclosed, for the purposes other than including into the data filing system, to persons and subjects other than those referred to in paragraph 1 above, provided that such persons or subjects present reliably their reasons for being granted the access to the data and that granting such access will not violate the rights and freedoms of the data subjects.
3. Personal data are disclosed at written and justified requests, unless the provisions of another law state otherwise. Such requests should include information allowing for identification of the requested personal data within the filing system and indicating their scope and purpose.
4. Disclosed personal data shall be used only pursuant to the purpose for which they have been disclosed.

However, the VAC stressed that fact that collector’s discretion cannot mean its arbitrariness. In the case of the unfounded refusal to provide personal data according Article 29 (2) of the PPD, the General Inspector for Personal Data Protection shall have the right – in accordance with Article 18(1) pt. 2 of the PPD – to require the disclosure of personal data.

1. In case of any breach of the provisions on personal data protection, the Inspector General ex officio or upon a motion of a person concerned, by means of an administrative decision, shall order to restore the proper legal state, and in particular:
(…)
2) to complete, update, correct, disclose, or not to disclose personal data,

Undoubtedly, the request for the disclosure of personal data must be credible and legitimate. Thus, if such request is do not precluded by provisions of article 27 of the PPD, the collector must disclose such data.

1. The processing of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, religious, party or trade-union membership, as well as the processing of data concerning health, genetic code, addictions or sex life and data relating to convictions, decisions on penalty, fines and other decisions issued in court or administrative proceedings shall be prohibited.
2. Processing of the data referred to in paragraph 1 above shall not constitute a breach of the Act where:
1) the data subject has given his/her written consent, unless the processing consists in erasure of personal data,
2) the specific provisions of other statute provide for the processing of such data without the data subject’s consent and provide for adequate safeguards,
3) processing is necessary to protect the vital interests of the data subject or of another person where the data subject is physically or legally incapable of giving his/her consent until the establishing of a guardian or a curator,
4) processing is necessary for the purposes of carrying out the statutory objectives of churches and other religious unions, associations, foundations, and other non-profitseeking organisations or institutions with a political, scientific, religious, philosophical, or trade-union aim and provided that the processing relates solely to the members of those organisations or institutions or to the persons who have a regular contact with them in connection with their activity and subject to providing appropriate safeguards of the processed data,
5) processing relates to the data necessary to pursue a legal claim,
6) processing is necessary for the purposes of carrying out the obligations of the controller with regard to employment of his/her employees and other persons, and the scope of processing is provided by the law,
7) processing is required for the purposes of preventive medicine, the provision of care or treatment, where the data are processed by a health professional subject involved in treatment, other health care services, or the management of health care services and subject to providing appropriate safeguards,
8) the processing relates to those data which were made publicly available by the data subject,
9) it is necessary to conduct scientific researches including preparations of a thesis required for graduating from university or receiving a degree; any results of scientific researches shall not be published in a way which allows identifying data subjects,
10) data processing is conducted by a party to exercise the rights and duties resulting from decisions issued in court or administrative proceedings.

The Court had to consider the question of whether the application met the conditions set in Article 29 of the PPD. The legal representative proved that, the disclosure of personal data of a person who registered the disputed domain because was necessary for the initation of the arbitration proceedings before the Court of Conciliation at the the Polish Chamber of Information Technology and Telecommunications. The Court noted that the arbitration proceedings are held in accordance with Article 1188 § 1 of the Civil Proceedings Code – CPC – (in Polish: Kodeks Postępowania Cywilnego) of 17 November 1964, published in Journal of Laws (Dziennik Ustaw) No 43, item 296, with subsequent amendments. The proceedings before the Court of Conciliation starts with the lodging of the statement of claim (the suit), which means that the suit should comply with the conditions laid down in Article 187 § 1 of the CPC. Under that provision, the statement of claim should meet the requirements of the pleading, and it also shall include: clearly defined demand in matters of property rights and the value of the claim, unless the case concerns the amount of money. The suit shall include all facts justifying the request and, if necessary, to justify the jurisdiction of the court. In accordance with Article 126 § 1 pt. 1 of the CPC, every pleading shall also contain, inter alia, the designation of the court to which it is addressed, the name or names of the parties, their legal representatives and/or agents. Therefore, the essential element of the claim for infringement of personal rights is to show the person against whom the request is addressed, i.e. the defendant in future proceedings for infringement of personal rights, and defendant’s address. The VAC found that the request in the Home.pl case was fully justified. The Court also confirmed that Home.pl is the controller within the meaning of Article 7(4) of the PPD, because according to the agreement with NASK, Home.pl decides on the purposes and means of the processing of personal data related to people who registered domain names. Thus, the party of the case was Home.pl, not NASK.

Personal data protection, case II SA/Wa 1085/04

February 11th, 2010, Tomasz Rychlicki

In July 2003, the Inspector General for Personal Data Protection (GIODO) received a complaint in which a natural person, known as W.K. (personal data of the parties are removed from Polish courts’ judgments), requested the GIODO to issue an order to the Polish Internet company to reveal personal data of persons, against which the applicant wanted to initiate legal proceedings. The complaint showed that the online forum operated by the Internet company hosted defamatory content posted by persons using only nicknames.

W.K. proved that he had requested the Company to disclose full IP addresses of computers from which persons using only nicknames have sent messages to the online forum. The applicant also pointed out that the Regional Prosecutor’s Office refused to determine the perpetrators of the alleged defamation. The refusal was also upheld by the District Prosecutor’s Office.

W.K. pointed out that he brought a private accusation based on article 212 § 1 of the Criminal Code – CRC – (in Polish: Kodeks Karny) of 6 June 1997, Journal of Laws (Dziennik Ustaw) No 88, item 553, with later amendments, to the Regional Court in K., against the persons who used given nicknames. The Court has issued an order in which it considered the private accusation legally ineffective because it included error in the form – i.e., no indication of names of defendants and their addresses, and W.K. did not clear these errors.

The GIODO has found that the purpose for which W.K. has applied for, i.e. the access to personal data, to assert his rights before the court, is legally justified. The use of these data by the applicant in the proceedings could not be considered as a violation of the rights and freedoms of persons whos personal data was collected because after the initiation of criminal or civil proceedings, personal data would be in a disposition the court.

The Company filed a complaint to the Voivodeship Administrative Court (VAC) in Warsaw. The Court in a judgment of 9 February 2005, case file II SA/Wa 1085/04, annulled the contested decision. The VAC held that the complaint was based on article 23(1) pt. 5 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), Journal of Laws (Dziennik Ustaw) of 29 October 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with later amendments.

1. The processing of data is permitted only if:
5) processing is necessary for the purpose of the legitimate interests pursued by the controllers or data recipients, provided that the processing does not violate the rights and freedoms of the data subject.

The court did not accept that the wording of this provision can be interpreted as a rule requiring a data controller to reveal personal data at the request of the person whose requested data does not concern. The basis for such claims available for third parties for purposes other than inclusion in the data collection, was provided in the article 29(1) and (2) of the PPD. This provision being in force until 1 May 2004, did not give rise to demand release of the data, if the controller/administrator of the data were private sector.

The Court also held that the imposition of the duty of the data controller can only be done when the information being available to the controller falls into the category of personal data as defined in article 6(1) of the PPD.

personal data shall mean any information relating to an identified or identifiable natural person.

The requested information related to IP addresses of computers from which the messages were posted by certain people using certain nicknames. The Company argued that it does not require users of its forum to identify themselves in order to post information, what causes that, the IT administration system of the portal website hosting different forums, registers only IP address of computers of persons using the system, and it does not produce other data for identifying the user of a forum. Only a request to the operator of the telecommunication network could lead to the identification of the computer which was connected to the server hosting the portal and its forums. The Court cited English and Polish comentators and found that information, that without extraordinary and disproportionate effort can be “linked” with a specific person, especially by using readily and widely available sources, also deserve credit for their category of personal data. The identifiable person is defined in article 6(2) of the Polish Act of August 29, 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with later amendments.

2. An identifiable person is the one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity.
3. A piece of information shall not be regarded as identifying where the identification requires an unreasonable amount of time, cost and manpower.

Personal data protection, case I OSK 1079/10

February 5th, 2010, Tomasz Rychlicki

According to lawyers representing the singer Maryla Rodowicz, on the forum of one of the Polish portal websites appeared entries with the content which allegedly violated her personal rights (interests). The lawyers requested the owner to reveal IP addresses of users who posted these entries. The administrator of the portal website deleted the disputed entries but did not reveal any of the IP addresses. Lawyers filed a request to the Inspector General for Personal Data Protection (GIODO), who ordered the portal to disclose IPs on the grounds that these numbers are personal data. The owner of the portal again refused. The case went to the Voivodeship Administrative Court (VAC) in Warsaw, which in a judgment of 3 February 2010, case file II SA/Wa 1598/09 upheld the decision of the GIODO. The company who owns the portal may file a cassation to the Supreme Administrative Court (SAC). The VAC judgment provides the interpretation that IP address is a personal data, in accordance with the statutory definition included in article 6 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with later amendments.

Article 6
1. Within the meaning of the Act personal data shall mean any information relating to an identified or identifiable natural person.
2. An identifiable person is the one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity.
3. A piece of information shall not be regarded as identifying where the identification requires an unreasonable amount of time, cost and manpower.

The VAC also noted that the IP address is personal data if it is permanently assigned to the specified device, and that device is used or operated by a specified entity. This dependence makes certain, in given situations, that there is the possibility of identifying such entity. The Court said that it is true that the IP address itself is not sufficient to identify a person who use it, but together with other information a person can be identified. Grupa o2, the owner of a portal website filed a cassation complaint.

The Supreme Administrative Court in its judgment of 19 May 2011 case file I OSK 1079/10 dismissed the complaint and decided that information on the date and contents of the posts that are correlated with IP addresses, allows for unambiguous determination of identity of persons who have violated someone’s personal interests.

There was another court’s decision with regard to the aforementioned case and the disclosure of IP addresses. See “Telecommunications law, case I OSK 1079/10“. The U.S. courts and judges have quite different views on this issue. Read for example Johnson v. Microsoft Corp., 2009 WL 1794400 (W.D. Wash. June 23, 2009).

Polish regulations on personal data protection

January 11th, 2010, Tomasz Rychlicki

I. The law
The main sources of binding laws in the Republic of Poland are the Constitution of 2 April 1997, acts passed by the Parliament, ratified international treaties and regulations issued, for example, by the Prime Minister or the Council of Ministers – Polish government. Regulations are issued for the purpose of implementation of acts. The main legal acts on personal data protection in the Republic of Poland are the following.

I.A. Substantive law

The Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with subsequent amendments.
The Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments.

I.B. Procedural law

Administrative Proceedings Code – APC – (in Polish: Kodeks postępowania administracyjnego) of 14 June 1960, Journal of Laws (Dziennik Ustaw) No. 30, item 168, consolidated text of 9 October 2000, Journal of Laws (Dziennik Ustaw) No. 98, item 1071 with subsequent amendments.
Act on proceedings before administrative courts – PBAC – (in Polish:Prawo o postępowaniu przed sądami administracyjnymi) of 30 August 2002, Journal of Laws (Dziennik Ustaw) No. 153, item 1270, with subsequent amendments.
Civil Proceedings Code – CPC (in Polish: Kodeks Postępowania Cywilnego) of 17 November 1964, Journal of Laws (Dziennik Ustaw) No. 43, item 296, with subsequent amendments.

I.C. Case law
See “Polish case law on personal data protection“.

I.D. EU law
Since 1 May 2004, which was the accession day to the EU, the Republic of Poland has been bound by all aquis communitaire, including judgments of the Court of Justice of the European Union.

I.E. International law
The Republic of Poland is a party of many International treaties and agreements concerning the protection of personal data.

II. National bodies and procedures
The Inspector General for Personal Data Protection decides cases within its competence under provisions of the Code of Administrative Proceedings, unless provided for otherwise. A party dissatisfied with a decision issued by the GIODO may request for the reconsidering of the case. The decision by the GIODO on the application to reconsider the case may be appealed against with the Voivodeship Administrative Court. The judgment of the VAC may be a subject to a cassation complaint which is decided by the Supreme Administrative Court.

Polish case law on personal data protection

December 11th, 2009, Tomasz Rychlicki

Below you will find a list of judgments and decisions on personal data protection in the context of IT technologies. You can find a more detailed discussion on each judgment or decision under the link provided with the case file. All judgments and decisions are given in chronological order.

– The judgment of the Supreme Administrative Court of 21 August 2013 case file I OSK 1666/12.

– The judgment of the Voivodeship Administrative Court of 7 October 2011 case file II SA/Wa 364/11.

– The judgment of the Supreme Administrative Court of 19 May 2011 case file I OSK 1086/10.

– The judgment of the Supreme Administrative Court of 19 May 2011 case file I OSK 1079/10.

– The judgment of the Voivodeship Administrative Court in Warsaw of 16 March 2011 case file II SA/Wa 2037/10.

– The judgment of the Voivodeship Administrative Court in Warsaw, of 1 December 2010, case file II SA/Wa 1212/10. This judgment is not yet final.

– The decision of the Inspector General for Personal Data Protection of 13 September 2010 case file DOLiS/DEC-1013/10.

– The order of the Supreme Administrative Court of 15 July 2010 case file I OSK 1079/10. This decison is related to the judgment of the Voivodeship Administrative Court in Warsaw, of 3 February 2010, case file II SA/Wa 1598/09.

– The judgment of the Supreme Administrative Court of 11 May 2010, case file I OSK 963/09.

– The judgment of the Supreme Administrative Court of 15 March 2010 case file I OSK 756/09.

– The judgment of the Voivodeship Administrative Court in Warsaw, of 3 February 2010, case file II SA/Wa 1598/09. This judgment is not yet final. The cassation complaint may be filed to the Supreme Administrative Court.

– The judgment of the Supreme Administrative Court in Warsaw, of 18 November 2009, case file I OSK 667/09.

– The judgment of the Voivodeship Administrative Court in Warsaw of 26 August 2009 case file II SA/Wa 297/09.

– The judgment of the Supreme Administrative Court of 3 July 2009 case file I OSK 633/08.

– The judgment of the Voivodeship Administrative Court in Warsaw of 3 March 2009, case file II SA/Wa 1495/08.

– The judgment of the Supreme Administrative Court of 26 January 2009 case file I OSK 174/08.

– The judgment of the Voivodeship Administrative Court in Warsaw of 30 Novmeber 2007, case file II SA/Wa 71/07.

– The judgment of the Voivodeship Administrative Court in Warsaw of 9 February 2005, case file II SA/Wa 1085/04.

Personal data protection, case II SA/Wa 297/09

October 21st, 2009, Tomasz Rychlicki

An individual had a telecommunications services agreement with a Company, but failed to comply with the payment and the Company has assigned the claim to another entity. The debtor requested by the assignee filed a complaint to the Inspector General for Personal Data Protection. It found that the operation of the company not been in conflict with the provisions of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments. The debtor filed a complaint against this decision.

The Voivodeship Administrative Court in Warsaw in its judgment of 26 August 2009 case file II SA/Wa 297/09 held that the transfer of the debt is inseparably connected with the transfer of personal data of the debtor. Such situation is in accordance with the provisions of Article 509 § 2 of the Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, published in Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments.

Article 509. § 1. The creditor may, without the debtor’s consent, transfer the receivable debt upon a third party (assignment) unless that would be at variance with statutory law, a contractual stipulation, or the nature of the obligation.
§ 2. Together with the receivable debt, the rights connected therewith shall pass to the acquirer, in particular, the claim for the interest in arrear.

All related rights together with the debt claim are transferred to the acquirer, and thus the right to dispose of the debtor’s personal information in order to implement the debt. The acquirer becomes autonomous possessor of the debtor’s personal data. The acquirer becomes the controller of personal data and processes personal information for its own account and risk. The acquirer enjoys the same rights and obligations relating to the processing of personal data as the previous controller.

Personal data protection, case I OSK 174/08

September 26th, 2009, Tomasz Rychlicki

The biggest Polish telecommunication company – Telekomunikacja Polska S.A. posted on its website an offer to sell its databases. This offer was addressed to research and telemarketing companies, BTL advertising agencies, insurance companies and banks. TP proposed a disclosure of private telephone numbers of its subscribers as part of the database. Through this service the company was preparing a database of phone numbers compatible with the order placed and then it passed the database on a CD for a client with a protocol of receipt. The phone numbers could be selected or sorted according to geographical criteria.

The Inspector General for Personal Data Protection ordered not to disclose of personal data of subscribers of Telekomunikacja Polska’s who are consumers within the meaning of Article 22¹ of the Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, published in Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments, to third parties in the future.

Article 22¹
The consumer shall be deemed to be any natural person who performs acts in law which are not directly connected with his economic or professional activity.

The prohibition was not allowed without fulfilling one of the conditions of Article 23(1) of the Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with subsequent amendments.

Article 23
1. The processing of data is permitted only if:
1) the data subject has given his/her consent, unless the processing consists in erasure of personal data,
2) processing is necessary for the purpose of exercise of rights and duties resulting from a legal provision,
3) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract,
4) processing is necessary for the performance of tasks provided for by law and carried out in the public interest,
5) processing is necessary for the purpose of the legitimate interests pursued by the controllers or data recipients, provided that the processing does not violate the rights and freedoms of the data subject.

The GIODO held that according to Article 159(1) of the Polish Act of 16 July 2000 on Telecommunications Law – TLA – (in Polish: Prawo telekomunikacyjne), published in Journal of Laws (Dziennik Ustaw) No 171, item 1800 with subsequent amendments, phone numbers are deemed as the telecommunications secrecy. Telekomunikacja Polska S.A. filed a complaint against this decision.

The Voivodeship Administrative Court in Warsaw in its judgment of 12 November 2007 case file II SA/Wa 1252/07 dismissed this case and TP S.A. decided to file a cassation complaint.

The Supreme Administrative Court in its judgment of 26 January 2009 case file I OSK 174/08 dismissed the cassation and held that Article 159(1) TLA provides for stronger data protection than the provisions of Article 23 of the PPD and therefore it will be used as a basis for legalizing the processing of telecommunications secrecy.

Personal data protection, case II SA/Wa 1495/08

March 30th, 2009, Tomasz Rychlicki

The Voivodeship Administrative Court in Warsaw in its judgment of 3 March 2009, case file II SA/Wa 1495/08 decided on the protection of personal data and providing and operating online services such as websites about users’ classmates. The VAC ruled that in accordance with article 6(2) of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, not only information on the current situation of an individual decide whether one is dealing with personal data, but also information relating to what a person did and who one was in the past. It means that such data are protected under the Act on Protection of Personal Data.

Personal rights, case I ACa 385/2006

July 31st, 2008, Tomasz Rychlicki

Update on Februrary 27, 2010.
I reported on a final judgment in Justyna Steczkowska’s case in my post entitled “Personal rights, case I ACa 1176/09“.

My post that was written in Polish language is too long and probably boring for most of you. It concerns Justyna Steczkowska’s naked pictures taken during her holiday at Turkish Rivera and being published by “Super Express”, which is one of many Polish tabliods. I also wrote about some comments that were posted by Polish lawyers regarding the right of privacy issue and I wanted to write a comparative note about American and Polish legal systems but I am way too busy for such undertaking. I can only tell you that Maciej Ślusarek, an attorney representing Justyna Steczkowska, will have easier case in Poland as opposed to the US legal reality. Mr. Ślusarek previously won a case against “Super Express” publisher and editor-in-chief. It was a very important judgment of the Appellate Court in Warsaw of 29 September 2006 case file I ACa 385/2006. Mr. Ślusarek represented another Polish singer Edyta Górniak. The Court held that there is a need to distinguish the persons carrying out the public functions, if a person due to the character of those functions might be subjected to public control and the openness of their life is justified by the important society interest, from the commonly known persons, who are not subjected to such intense public control. The distinction included in court’s ruling is of course of great importance for protection limitations established for such persons.

The protection of personal image/publicity rights is provided in Article 23 of the Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, published in Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments. This provision outlines the personal image as one of the personal property/interests – an intangible personal right. Furthermore, a person who would like to claim an infringment of his/her rights might also exercise the civil protection of personal image afforded by provisions of the Polish Act of 4 February 1994 on Authors Rights and Neighbouring Rights – ARNR – (in Polish: ustawa o prawie autorskim i prawach pokrewnych), published in Journal of Laws (Dziennik Ustaw) No 24, item 83, consolidated text of 16 May 2006, Journal of Laws (Dziennik Ustaw) No 90, item 631 with subsequent amendments.

Article 81.
1. The dissemination of an image shall require the permission of the person presented in that image. Unless there is a clear reservation, such permission shall not be required if such person has received the agreed price for posing.
2. The permission shall not be required for the dissemination of the image:
1) of a commonly known person, if such image has been made in connection with his/her performance of public functions and, in particular, political, social or professional functions,
2) of a person constituting only a detail of a whole, such as a meeting, a landscape, or a public event.
(…)
Article 83.
The provisions of Article 78, paragraph 1 shall apply respectively to claims brought due to the dissemination of the image of the person presented in it and the dissemination of correspondence without the required permission of the person to whom it was addressed; such claims may not be asserted after the lapse of twenty years from the death of that person.

Additional protection is also provided in the Act of 26 January 1984 on Press Law, the Criminal Code and the Act of 29 August 1997 on Protection of Personal Data. The protection of privacy and publicity may also derive from the Constitution of the Republic of Poland of 2 April 1997.

Article 47
Everyone shall have the right to legal protection of his private and family life, of his honour and good reputation and to make decisions about his personal life.
(…)
Article 54
1. The freedom to express opinions, to acquire and to disseminate information shall be ensured to everyone.
2. Preventive censorship of the means of social communication and the licensing of the press shall be prohibited. Statutes may require the receipt of a permit for the operation of a radio or television station.

And, of course, from the European Convention on Human Rights of 4 November 1950.