Court case III OSK 2508/25 – Court Ruling (Poland, 2026)

The data subject had previously worked as an IT specialist of a city. In May 2019, his work computer was supposed to be handed over to another employee. The data subject had remained logged into his personal account on Facebook that contained conversations between him and other employees of the city. The employee responsible for handing over the computer printed out the conversations and gave them to the mayor (the controller), who used them to initiate disciplinary and criminal proceedings against the employees. The data subject filed a complaint with the supervisory authority regarding the processing of his personal data contained in the Facebook conversations. The DPA reprimanded the controller for violations of Articles 5(1)(a), 5(1)(b), 6(1), and 9(1) GDPR in September 2020. According to the DPA, there had been no legal basis for the processing of personal data that also included information about the data subject’s religion. The controller appealed the decision. The court of first instance held the case concerned the secrecy of correspondence instead of data protection and annulled the DPA decision in 2021. The Supreme Administrative Court overturned this decision in 2025 and referred the case to the court of first instance for re-examination. This time, the court of first instance dismissed the appeal and deemed the DPA decision correct. The controller appealed further to the Supreme Administrative court, arguing that he had not processed personal data. The Supreme Administrative Court dismissed the controller’s appeal as unfounded. In the court’s view, the data subject’s login credentials, profile information and information in the Facebook conversations clearly constituted personal data within the meaning of Article 4(1) GDPR: logging in allowed access to the profile of a specific natural person and therefore identified them. Second, the court held that the controller had undeniably processed personal data pursuant to Article 4(2) GDPR. The controller could view, collect, download, print out, and use personal data of the data subject and other individuals after using the login credentials to access his Facebook account. In addition, the controller had further processed the personal data by using the content of private Facebook conversations in paper form.