Court case II SA/Wa 2378/20 – Court Ruling (Poland, 2021)

The President of the Office for Personal Data Protection, after conducting administrative proceedings on the processing of personal data by ClickQuickNow, issued a decision finding that the entity had violated the principle of lawfulness, fairness and transparency of personal data processing. In addition, he found that the company violated Article 7 (3) GDPR, Article 12 (2) GDPR, Article 17 (1)(b)GDPR and Article 24 (1) GDPR, by failing to implement appropriate technical and organisational measures to enable the data subject to easily and effectively withdraw consent to the processing of his personal data and to exercise his right to request the immediate erasure of his personal data (right to be forgotten). In addition, the supervisory authority found that the company processed without legal basis the data of persons who are not its customers, from whom it received requests to cease processing personal data. A fine of €47,000 was imposed on the company. The company appealed against this decision to the Provincial Administrative Court. The court dismissed the complaint and held that the controller is obliged to provide the data subject with the possibility to withdraw consent as easily as to give consent. While the controller may provide for an easier way to withdraw consent than to give consent, it may not limit this right by adopting solutions that would make it more difficult to provide a statement of withdrawal of consent than to provide a statement of consent. Asking the data subject about the reasons for withdrawing consent has no legal basis and is a deliberate action aimed at obstructing or even preventing the exercise of data subjects' rights. Such action constitutes at the same time an infringement of the principle of lawfulness, transparency and fairness of data processing. In the Court's view, the procedure applied by the company in the process of revoking consent to the processing of personal data previously obtained by the company does not meet the criteria of a simple and quick revocation of consent and constitutes a violation of the provisions of the GDPR. The court found that the company was not only failing to facilitate, but was actually making it more difficult for data subjects to exercise their right to erasure of personal data.