Bisnode – Court Ruling (Poland, 2019)

"The entrepreneur conducting business activity consisting in obtaining information, including personal data of persons conducting business activity, from publicly available public registers [e.g. the National Court Register (KRS), the Central Registration and Information on Business (CEIDG), the Registry of National Economy (REGON)] and in analysing, interpreting and subsequently making this information available to interested customers, must comply with the information obligation in relation to those persons referred to in Article 14 of the General Data Protection Regulation (GDPR) by providing information directly to the data subject, as is apparent from the judgment of the Voivodeship Administrative Court in Warsaw of 11 December 2019 (ref. no.: II SA/Wa 1030/19). Moreover, according to the Voivodeship Administrative Court, the possible high cost of sending this information by post does not constitute a basis for the exemption from the information obligation. This concerns a case in which the President of the Personal Data Protection Office ordered by way of an administrative decision to fulfill the information obligation and imposed on the company an administrative fine in the amount of more than PLN 943 000 (for more information on this issue see: https://uodo.gov.pl/pl/138/786). Let us recall that the company was penalised in connection with a breach of the information obligation (Article 14 (1-3) of the General Data Protection Regulation), consisting in failure to provide the information contained in Article 14(1) GDPR and Article 14(2) GDPR to all natural persons whose personal data are processed by the company who are currently or were in the past sole traders, as well as to natural persons who have suspended their activity as sole traders. The company appealed to the Voivodeship Administrative Court against that decision. It argued, inter alia, that it was not under the information obligation resulting from Article 14 of the GDPR. The entity considered tha