Polish IP & IT law – copyright trademark computer internet telecomm

Archive for: Art. 12(2) PPD

Personal data protection, case II SA/Wa 2037/10

May 12th, 2011, Tomasz Rychlicki

The Polish branch of McDonald’s Corp. has made a promotional campaign based on the issuance of the so-called “bonificards” i.e. discount cards entitling the holder to purchase certain McDonald’s products at a reduced price. Only employees and business partners were allowed to use such cards. The terms of the promotion explicitly stated that the cards cannot be resold. McDonald’s learned that cards were offered for sale or as a free bonus to other items sold on Allegro – Polish Internet auctions website.

McDonald’s requested Allegro to disclose personal data of persons engaged in the above mentioned auctions, on the grounds that these buyers and sellers violated the terms and rules of promotion, and thus McDonald’s intended to take steps to – on one hand – to deprive sellers of their wrongfully obtained benefits, on the other hand – to take away all bonificards from people who bought them. Allegro refused to provide requested data, indicating that there was no reason to assume that there was any kind of illegal action, arguing that disclosure may be classified as unlawful conduct of the controller that violates personal interests of the users and that may result in Allegro’s responsibility that is based on civil law regulations.

McDonald’s requested the Inspector General for Personal Data Protection to order Allegro the disclosure of information previously requested. The GIODO refused and pointed out that in this case the interests of McDonald’s cannot prevail over the interests of persons affected by the request. The disclosure of such data would be, in fact, too far-reaching interference with the privacy of the person concerned. McDonald’s filed a complaint against these decisions.

The Voivodeship Administrative Court in Warsaw in its judgment of 16 March 2011 case file II SA/Wa 2037/10 overruled GIODO’s decisions. The VAC held that McDonald’s has the right to know who offers promotion cards at online auctions provided by Allegro. The Court ruled that the provisions of the PPD cannot be interpreted as meaning that the disclosure of personal data of a person who offer to sell someone else’s property, violates that person’s interests. The protection of interests of one person cannot be done without prejudice to the rights of others. Especially, when such persons knew that they were trying to dispose of someone’s else things whose value was measured in money (the value of the Company’s products that were available in the promotional terms). The court ordered to reconsider the case, where the GIODO shall take into account all comments made by the VAC. The GIODO decided to file a cassation complaint.

The Supreme Administrative Court in its judgments case files I OSK 834/11 and I OSK 1137/11 agreed with the GIODO. The Court held that in the case of electronic services, personal data may be disclosed only for the purposes of criminal proceedings.

Personal data protection, case I OSK 756/09

July 11th, 2010, Tomasz Rychlicki

A former entrepreneur (natural person) requested a telecommunications company to remove his personal data that were used for marketing purposes. The company did not want to take into account the above-mentioned demands, arguing that the rights provided in Article 33 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, are not afforded for persons who perform or performed professional business activity (entrepreneurs).

Article 33
1. At the request of the data subject, within the period of 30 days, the controller shall be obliged to notify the data subject about his/her rights, and provide him/her with the information referred to in Article 32 paragraph 1 point 1-5a as regards his/her personal data, and in particular specify in an intelligible form:
1) the category of personal data contained in the file,
2) the means of data collection,
3) the purpose and the scope of data processing,
4) the recipients of the data and the scope of access they have been granted.
2. At the request of the data subject, the information referred to in paragraph 1 shall be given in writing.

The Supreme Administrative Court in its judgment of 15 March 2010 case file I OSK 756/09 held that provisions of Article 6 of the PPD does not differentiate the rights of individuals, depending on whether they are performing business activity or not. In this situation, there was no reason to exclude information about natural persons conducting business/economic activity from the protection guaranteed by the PPD.

Article 6
1. Within the meaning of the Act personal data shall mean any information relating to an identified or identifiable natural person.
2. An identifiable person is the one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his/her physical, physiological, mental, economic, cultural or social identity.
3. A piece of information shall not be regarded as identifying where the identification requires an unreasonable amount of time, cost and manpower.

Personal data protection, case I OSK 174/08

September 26th, 2009, Tomasz Rychlicki

The biggest Polish telecommunication company – Telekomunikacja Polska S.A. posted on its website an offer to sell its databases. This offer was addressed to research and telemarketing companies, BTL advertising agencies, insurance companies and banks. TP proposed a disclosure of private telephone numbers of its subscribers as part of the database. Through this service the company was preparing a database of phone numbers compatible with the order placed and then it passed the database on a CD for a client with a protocol of receipt. The phone numbers could be selected or sorted according to geographical criteria.

The Inspector General for Personal Data Protection ordered not to disclose of personal data of subscribers of Telekomunikacja Polska’s who are consumers within the meaning of Article 22¹ of the Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, published in Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments, to third parties in the future.

Article 22¹
The consumer shall be deemed to be any natural person who performs acts in law which are not directly connected with his economic or professional activity.

The prohibition was not allowed without fulfilling one of the conditions of Article 23(1) of the Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), published in Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with subsequent amendments.

Article 23
1. The processing of data is permitted only if:
1) the data subject has given his/her consent, unless the processing consists in erasure of personal data,
2) processing is necessary for the purpose of exercise of rights and duties resulting from a legal provision,
3) processing is necessary for the performance of a contract to which the data subject is a party or in order to take steps at the request of the data subject prior to entering into a contract,
4) processing is necessary for the performance of tasks provided for by law and carried out in the public interest,
5) processing is necessary for the purpose of the legitimate interests pursued by the controllers or data recipients, provided that the processing does not violate the rights and freedoms of the data subject.

The GIODO held that according to Article 159(1) of the Polish Act of 16 July 2000 on Telecommunications Law – TLA – (in Polish: Prawo telekomunikacyjne), published in Journal of Laws (Dziennik Ustaw) No 171, item 1800 with subsequent amendments, phone numbers are deemed as the telecommunications secrecy. Telekomunikacja Polska S.A. filed a complaint against this decision.

The Voivodeship Administrative Court in Warsaw in its judgment of 12 November 2007 case file II SA/Wa 1252/07 dismissed this case and TP S.A. decided to file a cassation complaint.

The Supreme Administrative Court in its judgment of 26 January 2009 case file I OSK 174/08 dismissed the cassation and held that Article 159(1) TLA provides for stronger data protection than the provisions of Article 23 of the PPD and therefore it will be used as a basis for legalizing the processing of telecommunications secrecy.