Ubezpieczeniowy Fundusz Gwarancyjny – Court Ruling (Poland, 2024)

A data subject filed a complaint with the Polish DPA (UODO) in September claiming that an insurance company (the controller) unlawfully processed and transferred their personal data to [https://www.ufg.pl/infoportal/faces/pages_home-page?_afrLoop=11910042574273553&_afrWindowMode=0&_adf.ctrl-state=nawhddp69_4 the Insurance Guarantee Fund] (Ubezpieczeniowy Fundusz Gwarancyjny). Under the Polish law, the Insurance Guarantee Fund held register of insured entities. The DPA asked the controller and the Insurance Guarantee Fund to make statements regarding the complaint. In December, the data subject filed a statement, lamenting the DPA's alleged inactivity and prolongation of the proceedings. Also, the data subject asked for the copies of all documents sent to the DPA by the controller and the Insurance Guarantee Fund. The DPA refused to provide the data subject with such copies and continued to process the case. The data subject filed a complaint with the Voievodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie), claiming proceedings were prolonged by the DPA's inactivity. In the meantime, the DPA issued a decision. The court upheld the complaint against the DPA inactivity. According to the court, the DPA proceeded the case with protraction. There was no extenuating circumstances explaining the fact that the DPA examined the case for four months. Thus, the DPA violated Article 35 of [https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19600300168/U/D19600168Lj.pdf administrative procedure code] (kodeks postępowania administracyjnego) according to which in principle, DPA's should render their decision in one month. The DPA lodged the cassation appeal with the Supreme Administrative Court (Naczelny Sąd Administracyjny). The DPA stood on a position that it was Article 78(2) GDPR that determined the terms to examine the case. The court upheld the DPA's appeal. Article 78(2) GDPR was applicable to the case at hand. The three months term of Article 78(2) GDPR determined the time, in which the DPA was obliged to examine the case and issue a decision. Thus, Article 78(2) GDPR was a lex specialis, derogating the application of the general terms for case examination. Nevertheless, it was the DPA’s duty to inform the data subject about a delay in the closing of the case and its status, in accordance with Article 36 of administrative procedure code. If the DPA didn’t issues decision within three months, the data subject was entitled to bring a case for delayed proceedings by the DPA. However, the court of first instance failed to consider the DPA proceedings under Article 78(2) GDPR. Because of that, the case was sent back to the Voievodeship Administrative Court of Warsaw.