Court case II SA/Wa 310/20 – Court Ruling (Poland, 2020)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish court upheld a decision that L. Sp. z o.o. mishandled video surveillance data by not having a proper agreement in place. The company was fined because they didn't follow rules for handling personal data. This case highlights the importance of having clear agreements when processing personal data.
What happened
L. Sp. z o.o. processed video surveillance data without a proper agreement, violating GDPR rules.
Who was affected
Residents whose activities were captured by the video surveillance system.
What the authority found
The court agreed with the data protection authority that the company violated GDPR by not having a valid agreement for processing video data.
Why this matters
This ruling emphasizes the need for companies to have clear agreements when accessing or processing personal data, especially in shared spaces like residential communities.
GDPR Articles Cited
National Law Articles
The President of the Office for Personal Data Protection (PUODO) found that L. Sp. z o.o. ("the Company") infringed the provisions of Article 5(1)(a)GDPR, Article 5(1)(f)GDPR in connection with Article 5(2) GDPR, i.e. the principles of lawfulness, data integrity and confidentiality and accountability in connection with Article 28(1) GDPR, Article 28(3) GDPR, Article 28(10) GDPR and Article 29 GDPR, with regard to the processing of data from video surveillance systems used in the Residential Community without legal basis in the form of an agreement on entrustment of processing. The DPA stated that in the course of the proceedings the indicated shortcomings in the process of personal data processing were eliminated, but nevertheless imposed on the Company an administrative fine in the amount of PLN 8000.00 due to the duration of the violations. The DPA emphasised that, in the absence - in the data processing entrustment agreement of May 2018 concluded by the Housing Community - of entrusting the Company with the processing of data, including the determination of the purposes and means of processing of the data derived from the video surveillance system used at the property, to which the Company actually had access within the framework of the proper performance of the contract for the administration of the common part, pursuant to Article 28(10) GDPR, the Company was deemed to be the controller with regard to this process in the period from May 2018 to September 2019, i.e. until the date of conclusion of Annex No. 1 to the aforementioned contract. The Company appealed against the decision to the Provincial Administrative Court. Was it legitimate to consider that the Company was the controller of personal data in relation to the processing of video surveillance data? The Provincial Administrative Court Warsaw dismissed the appeal and held that on the basis of the factual findings, the PUODO stated correctly that the Company infringed the provisions on the protecti
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case II SA/Wa 310/20 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case II SA/Wa 310/20 - Poland (2020). Retrieved from cookiefines.eu
Last updated: