- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case II SA/Wa 1340/20 – Court Ruling (Poland, 2021)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A court ruled against a car rental company for unlawfully processing a user's personal data. The company kept the user's data without a valid reason after a complaint was filed. This ruling emphasizes that businesses must have a legitimate basis for retaining personal information.
What happened
The court upheld a decision that the car rental company unlawfully processed a user's personal data.
Who was affected
A user who rented a car and had their personal data processed by the company.
What the authority found
The court confirmed that the company did not have a valid legal basis for retaining the user's personal data.
Why this matters
This ruling highlights the need for companies to justify their data retention practices. Businesses should regularly review their data processing activities to ensure compliance with legal requirements.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 March 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
An individual lodged a complaint with the supervisory authority against the company, claiming that the company had unlawfully processed his personal data in connection with a car rental contract (including by means of a copy/scan of his identity card and driving licence). The company stated that it obtained the complainant's personal data from the complainant himself in connection with the conclusion of the car rental agreement, including his first name, surname, address, identity card number, driving licence number and telephone number, which it currently processes in its IT system designed for comprehensive servicing of car rental companies. The company submitted that it currently processed the complainant's personal data solely for the purpose of possibly establishing, investigating or defending against claims related to the car rental, on the basis of Article 6(1)(f) GDPR. Following an administrative investigation, the supervisory authority ordered the company to delete the complainant's personal data in terms of name, surname, address, identity card number, driving licence number. The DPA questioned the basis indicated by the Company for processing the complainant's personal data, as it did not appear from the evidence that the complainant had filed a claim against the Company or that the Company had asserted any claims against the complainant in court that would justify the Company's right to retain and process the complainant's personal data in connection with its safeguarding and assertion by the complainant or the Company. The Company appealed to the court. The court dismissed the controller's appeal against the supervisory authority's decision. The court pointed out that the legal basis for the processing of personal data listed in the provision of Article 6(1)(f) GDPR applies when the controller does not have the consent of the data subject, there is no provision which could constitute a basis for the processing of personal data, and when the controller
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case II SA/Wa 1340/20 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
11 March 2021
Authority
Urząd Ochrony Danych Osobowych
About this data
Cite as: Cookie Fines. Court case II SA/Wa 1340/20 - Poland (2021). Retrieved from cookiefines.eu
Last updated: