Court case III OSK 135/23 – Court Ruling (Poland, 2024)

The Chief of a County (Starosta Powiatowy, the controller) sent a letter addressed to an individual who co-owns land with the county. The letter referred to the fee for perpetual usufruct of the land (użytkowanie wieczyste; i.e. a temporary lease of state's land by a natural or legal person, up to 99 years, in exchange for an annual fee). However, the letter was delivered to another individual (the data subject) residing at the address used by the Chief of County. The data subject lodged a complaint with the Polish DPA (UODO). The individual argued the land’s co-owner did not reside in the address. The controller explained they used the land’s co-owner's registered address and the data subject's statement was not suffice to invalidate it. The DPA dismissed the case, emphasising the controller didn’t violated the GDPR by sending the correspondence on the registered address of the land’s co-owner. Additionally, the individual’s right to data protection was not violated, as the authority didn’t process their data, but data of the land’s co-owner. The individual appealed against the DPA’s decision. The Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie) upheld the DPA’s decision. Consequently, the individual brought the case before the Supreme Administrative Court (Naczelny Sąd Administracyjny). The Supreme Administrative Court dismissed the appeal. The court found no evidence of the controller’s misconduct. Also, the court confirmed the data subject was not affected. The authority acquired the address from the official register. The mere fact that the same address was shared by the data subject and the land’s co-owner didn’t amount to the GDPR violation. The court underlined that, in the case at hand, it was the land’s co-owner data processed, not the data subject's.