Court case 1592/23 – Court Ruling (Poland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish company faced a reprimand for making marketing calls to a person who requested their data be deleted. The data protection authority found that the company had no right to keep processing the person's data for marketing after the deletion request. This case shows that companies must respect users' wishes regarding their personal data.
What happened
The company continued to process a person's data for marketing despite receiving a deletion request.
Who was affected
The individual who received unwanted marketing calls after requesting data deletion was affected.
What the authority found
The Polish data protection authority ruled that the company unlawfully processed the person's data for marketing purposes after the deletion request.
Why this matters
This case highlights the need for companies to take user deletion requests seriously. Businesses must ensure they stop using personal data when requested by the user.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A company (the controller) entered into contract with another company represented by its CEO (the data subject). The data subject claimed that after the conclusion of the contract between the companies, the controller processed their data for marketing purposes, as they received marketing calls from the controller. The data subject requested (via e-mail) the controller to delete their data under Article 17 GDPR. Nevertheless, the data subject received another marketing call. The data subject file a complaint with the Polish DPA (UODO). During the proceedings, the controller explained that the data they processed were treated as data of a legal person, not the data subject’s data. After the investigation, the DPA stated that the controller processed the data under Article 6(1)(b) GDPR, since there was contractual relationship between the controller and the company represented by the data subject. Hence, the data provided with the controller served the purpose of facilitating the contract. Afterwards, the data subject filed another deletion request under Article 17 GDPR, regarding all their data processed by the controller. The controller answered the request and asked the data subject to clarify whether they wished to close the account with the controller. If so, the data subject was asked to send written application to close the account and delete the data. Once again, the data subject received marketing call from the controller. The data subject’s data was eventually deleted once the DPA contacted the controller. The DPA issued the reprimand against the controller for unlawful processing of data for marketing purposes. For the DPA, after the second deletion request, there was no legal basis in place to process the data for marketing purposes. The controller brought an appeal against the DPA’s decision before the Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The controller argued that, inter alia, they didn’t contac
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case 1592/23 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case 1592/23 - Poland (2024). Retrieved from cookiefines.eu
Last updated: