Court case 1592/23 – Court Ruling (Poland, 2024)

A company (the controller) entered into contract with another company represented by its CEO (the data subject). The data subject claimed that after the conclusion of the contract between the companies, the controller processed their data for marketing purposes, as they received marketing calls from the controller. The data subject requested (via e-mail) the controller to delete their data under Article 17 GDPR. Nevertheless, the data subject received another marketing call. The data subject file a complaint with the Polish DPA (UODO). During the proceedings, the controller explained that the data they processed were treated as data of a legal person, not the data subject’s data. After the investigation, the DPA stated that the controller processed the data under Article 6(1)(b) GDPR, since there was contractual relationship between the controller and the company represented by the data subject. Hence, the data provided with the controller served the purpose of facilitating the contract. Afterwards, the data subject filed another deletion request under Article 17 GDPR, regarding all their data processed by the controller. The controller answered the request and asked the data subject to clarify whether they wished to close the account with the controller. If so, the data subject was asked to send written application to close the account and delete the data. Once again, the data subject received marketing call from the controller. The data subject’s data was eventually deleted once the DPA contacted the controller. The DPA issued the reprimand against the controller for unlawful processing of data for marketing purposes. For the DPA, after the second deletion request, there was no legal basis in place to process the data for marketing purposes. The controller brought an appeal against the DPA’s decision before the Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The controller argued that, inter alia, they didn’t contac