Court case III OSK 4727/21 – Court Ruling (Poland, 2021)

The Polish DPA issued a decision ordering a health care institution to delete the personal data of a former employee stored on the hard drive of the company computer which he used during his employment. The DPA concluded that, in the present case, none of the prerequisites of Article 6(1) and Article 9(2) GDPR authorising the health care institution to process the complainant's personal data after termination existed. The health care institution argued that it needed to process the personal data of former employees in order to defend itself against possible civil claims, but the DPA explained that such a reason does not have legal justification as a basis for processing under the GDPR. Personal data cannot be processed 'as a back-up' with the assumption that the data may be useful in the future, and stored up until the statute of limitations for civil law claims. The DPA held that there were no grounds entitling the employer to process the data to defend itself from hypothetical claims in the future. This decision was appealed by the health institution to the Voivodship Administrative Court in Warsaw, which dismissed the complaint. The appellant further appealed against the judgment to the Supreme Administrative Court and requested that the contested decision be suspended. The appellant claimed that it was necessary to suspend the execution of the contested decision, since its execution would produce effects for the applicant which are impossible to reverse (via the destruction of potential evidence). The Polish Supreme Administrative Court sided with the Polish DPA, and held that the appellant did not prove premises justifying the suspension of the execution order of the appealed decision issued by the DPA. It held that reference to the processing of the complainant's personal data in order to defend against any claims is not legally justified and does not constitute a premise entitling to the processing of personal data. In the opinion of the Court, the risk of the possibly erroneous classification of the processing of personal data by the applicant as unlawful does not justify the suspension of the execution of the decision ordering the removal of personal data of the participant in the proceedings. Through a sort of balancing test, it reasoned that the risk to the rights of the data subject if the data is stored is greater than the risk to the applicant if the data is deleted.