President of UODO – Court Ruling (Poland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish school was ordered to delete a teacher's personal data used in her termination notice. The school had no legal basis for using information about her finances and assets from public records. This matters because it highlights the importance of having a valid reason to use someone's personal data, even if it's publicly available.
What happened
A school used a teacher's personal financial data from public records in her termination notice without a valid legal basis.
Who was affected
The teacher whose employment was terminated and whose personal financial data was used without proper justification.
What the authority found
The court ruled that the school had no valid legal basis under GDPR to process the teacher's financial data for the termination notice.
Why this matters
This case emphasizes that even publicly available data cannot be used without a valid legal reason. Schools and other employers should ensure they have a legitimate basis for processing personal data in employment matters.
GDPR Articles Cited
Applicant is the President of the Polish DPA (UODO) and defendant is a school (hereafter: controller). This appeal resulted from a decision by the DPA, in which it ordered the controller to remove certain processed' personal data of the complainant. The complainant is a teacher whose contract got terminated by the controller (her employer). She had received a notice of termination of her employment together with a statement of reasons, the content of which contained processed' personal data concerning her and her husband. She considered that she had never provided this personal data to the employer, and that this was not in line with the GDPR. Hence, she filed a complaint with the Polish DPA (UODO). In the justification for the termination of employment, the controller presented personal data obtained from public registers concerning the assets and income from complainant's business activity and agricultural activity, as one of the reasons for the termination. Furthermore, it stated that the processing of the this data resulted from the obligation to comply with all the orders imposed by law in terms of justifying the termination of the employment relationship for reasons beyond the employer's control (collective redundancies). In its decision, the DPA referred to the position of the Supreme Court in their judgement of 19 April 2019 (I PK 20/18), in which it held that the criteria for assessing the reasonableness of termination, such as family, personal or financial situation, do not fall within the concept of the reason for termination. They only constitute criteria for assessing the decision's legitimacy. In the light of the above, the DPA stated that the controller had no legal basis to process complainant's personal data obtained from publicly available public registers in the text of the termination notice, and thus violated Article 6 GDPR. Hence, the DPA ordered the controller to delete complainant's personal data concerning her assets and income from her bus
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for President of UODO in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. President of UODO - Poland (2021). Retrieved from cookiefines.eu
Last updated: