Court case XXV C 2596/19 – Court Ruling (Poland, 2020)

The data subject was the owner of the vehicle which was involved in the road collision. On the date of collision the vehicle was insured in terms of civil liability of motor vehicle holders. After the collision, the insurer handled the loss adjustment. The injured party in the subject traffic collision approached the insurer to send documentation regarding the loss. The insurer's employee sent to the injured party scans of the loss documentation, which were not anonymized, i.e. including the name of the data subject, her residence address, PESEL number, telephone number, and vehicle data. Later on, the insurer notified the data subject of the above incident, as a result of which personal data may have fallen into the wrong hands. Upon receipt of the above information, the data subject changed her cell phone number and stipulated to the bank that withdrawals from her bank account could only be made on her personal instruction. She was afraid of the negative consequences of having her personal data disclosed by the insurer, i.e. that someone would call her and that her data would be passed on. The injured party in the traffic collision did not contact the data subject or file a claim in court against her. The insurance company paid the injured party compensation under the data subject's insurance contract. The representative of the data subject requested the insurance company to pay the amount of PLN 10,000 as compensation due to the violation of the protection of the claimant's personal data by unauthorised disclosure to third parties. In its reply, the insurance company refused to accept the data subject's claim, arguing that the transfer of the claimant's personal data to the injured party was based on provisions of law. Whether there has been an unlawful transfer of personal data to a third party? Did the scope of personal data provided to the third party comply with the data minimization principle? The District Court in Warsaw held that under specific regula