Court case III OSK 2508/25 – Court Ruling (Poland, 2026)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish court ruled that a city employee's private Facebook messages were improperly shared with the mayor, leading to disciplinary actions against other employees. This case highlights the importance of protecting personal communications in the workplace. It shows that companies must handle personal data carefully to avoid legal issues.
What happened
A city employee's private Facebook conversations were printed and shared with the mayor without consent.
Who was affected
The employee whose private messages were shared and other employees involved in the disciplinary actions.
What the authority found
The court confirmed that there was no valid legal basis for processing the employee's personal data, violating data protection rules.
Why this matters
This ruling emphasizes the need for companies to respect employee privacy and handle personal data responsibly. It sets a precedent that improper handling of personal communications can lead to legal consequences.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The data subject had previously worked as an IT specialist of a city. In May 2019, his work computer was supposed to be handed over to another employee. The data subject had remained logged into his personal account on Facebook that contained conversations between him and other employees of the city. The employee responsible for handing over the computer printed out the conversations and gave them to the mayor (the controller), who used them to initiate disciplinary and criminal proceedings against the employees. The data subject filed a complaint with the supervisory authority regarding the processing of his personal data contained in the Facebook conversations. The DPA reprimanded the controller for violations of Articles 5(1)(a), 5(1)(b), 6(1), and 9(1) GDPR in September 2020. According to the DPA, there had been no legal basis for the processing of personal data that also included information about the data subject’s religion. The controller appealed the decision. The court of first instance held the case concerned the secrecy of correspondence instead of data protection and annulled the DPA decision in 2021. The Supreme Administrative Court overturned this decision in 2025 and referred the case to the court of first instance for re-examination. This time, the court of first instance dismissed the appeal and deemed the DPA decision correct. The controller appealed further to the Supreme Administrative court, arguing that he had not processed personal data. The Supreme Administrative Court dismissed the controller’s appeal as unfounded. In the court’s view, the data subject’s login credentials, profile information and information in the Facebook conversations clearly constituted personal data within the meaning of Article 4(1) GDPR: logging in allowed access to the profile of a specific natural person and therefore identified them. Second, the court held that the controller had undeniably processed personal data pursuant to Article 4(2) GDPR. The controller co
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case III OSK 2508/25 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case III OSK 2508/25 - Poland (2026). Retrieved from cookiefines.eu
Last updated: