Court case II SA/Wa 809/20 – Court Ruling (Poland, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish court ruled against a school for collecting children's fingerprints to manage canteen payments. The court found that the school did not have the right to process such sensitive biometric data. This case is important because it sets a clear boundary on how schools can handle personal data.
What happened
The school was found to be improperly collecting and processing biometric data from students.
Who was affected
Students at the primary school whose fingerprints were collected for meal verification.
What the authority found
The court ordered the school to stop collecting biometric data and delete any existing data, stating that such processing is generally prohibited.
Why this matters
This ruling clarifies that schools cannot collect sensitive biometric data without explicit legal grounds. It serves as a warning to educational institutions about the limits of data collection.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Review needed — 18 October 2026.
Processing notes: amount discrepancy.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
Polish DPA became aware of irregularities in the processing of personal data of pupils of the primary school consisting in the collection of fingerprints of children using the services of the school canteen. The school explained that it uses a biometric reader which is placed at the entrance to the school canteen and which identifies children who take meals in the school canteen in order to verify that they have paid for the meal of the day. The school indicated that it obtains the biometric data of its pupils on the basis of the written consent of the parent (legal guardian). The school further informed that upon termination of the contract for the use of lunches in the school canteen, the data needed for fingerprint identification, i.e. the string of bytes stored in the reader, is deleted. Polish DPA also found that, according to the lunch policy posted on the website of the canteen run by the school, pupils without biometric identification let everyone through and wait at the end of the queue , and once all pupils with biometric identification have entered the canteen, the admission of pupils without biometric identification begins one by one. As a result of the analysis of the collected evidence, the Polish DPA ordered the school to delete personal data in the area of digitized information on fingerprint characteristics of children using school canteen services, ordered the school to stop collecting personal data in the area of digitized information on fingerprint characteristics of children using school canteen services, and imposed a fine on the school in the amount of PLN 20,000.00 for the violation found in the decision. As the DPA argued, the common law provisions indicate the type of data that a school may obtain from its pupils, but none of them authorises the processing (acquisition and collection) of pupils' biometric data, the processing of which is in principle prohibited under Article 9(1) of the GDPR, for the purpose of the provision of school can
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case II SA/Wa 809/20 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case II SA/Wa 809/20 - Poland (2020). Retrieved from cookiefines.eu
Last updated: