DPA case DS.523.2582.2024 – Complaint Upheld (Poland, 2026)

The data subject requested the mayor of their place of residence (the controller) to provide them scans of contracts the city had concluded with certain companies and invoices issued to these companies in February 2024. In April 2024, the controller responded that he did not possess the requested documents. This response contained the first and last name as well as the email address of the data subject and was forwarded to multiple recipients, including one of the companies the data subject’s request concerned. Following this, the data subject filed a complaint with the DPA. The controller argued it had processed the data subject’s personal data solely for responding to the request for access to public information. In addition, the controller was of the opinion that the processing had been necessary to fulfil a legal obligation. Since the request concerned multiple parties, the controller had determined there had been special grounds for disclosing the processed data. The DPA issued the controller a reprimand for the disclosure of personal data to unauthorised entities without a legal basis. It held that the processing had not been lawful under Article 6(1)(c) GDPR, as the controller could have complied with its obligation to respond to the request for information without disclosing the data subject’s personal data. Furthermore, the DPA held that the controller had violated the principles of lawfulness and confidentiality laid down in Articles 5(1)(a) and 5(1)(f) GDPR respectively.