Court case III OSK 4558/21 – Court Ruling (Poland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
The Polish Supreme Administrative Court ruled that a foundation could keep personal data from the National Court Register on its website. The court found the foundation had a legitimate reason to process the data, even after a person asked for their information to be deleted. This case shows that organizations can sometimes keep public data online if they have a valid reason.
What happened
A foundation made personal data from the National Court Register available on its website, and a person requested their data be erased.
Who was affected
An individual whose personal data was displayed on the foundation's website in a paid version.
What the authority found
The court decided the foundation had a legitimate interest to process the data, meaning it didn't have to delete the information.
Why this matters
This case highlights that organizations can use public data if they have a valid reason, even if someone asks for their data to be removed. It emphasizes the importance of balancing public access to information with individual privacy rights.
GDPR Articles Cited
The controller is a foundation that makes personal data obtained via the National Court Register available on its website for the purpose of supporting the development of democracy by strengthening the citizens' rights of access to public information and re-use of public sector information. The data subject is an individual whose personal data had been processed by the foundation. This personal data included their name, surname, date of birth, gender, PESEL registration number, information on functions the data subject had in several (private) entities, and information on the value of their shares in such entities. The controller provided a free and a paid version of its website. The free version displayed only personal data that were linked to current ongoing activity of the data subject in several entities, and the shares they held in those entities. The paid version displayed also past activities of the data subject. In this case, the data subject's personal data was only accessible via the paid version of the website. The data subject submitted an erasure request pursuant to Article 17(1)(d) GDPR but the foundation rejected this request. The data subject then filed a complaint with the Polish DPA (UODO). The DPA rejected this complaint since it found that the controller had a legitimate interest to process the personal data under Article 6(1)(f) GDPR, and the data subject's interests or fundamental rights and freedoms did not override the controller's interest. The data subject did not accept this outcome and brought the action before court claiming inter alia that the controller had no legal basis to process the data. Hence, they did not object to the processing pursuant to Article 21 GDPR, but purely questioned its lawfulness. After the Court dismissed the appeal, the data subject brought the action before the Supreme Administrative Court. The Supreme Administrative Court dismissed the appeal, since it held that the processing was lawful. Consequently, th
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case III OSK 4558/21 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case III OSK 4558/21 - Poland (2021). Retrieved from cookiefines.eu
Last updated: