Court case III OSK 769/23 – Court Ruling (Poland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
Poland's Supreme Administrative Court ruled that a former member of Jehovah's Witnesses could not force the organization to erase her historical data. The court found that retaining this data was lawful under certain conditions, which is important for organizations handling sensitive information. This case shows that some data can be kept even after a person leaves an organization.
What happened
A former member of Jehovah's Witnesses claimed her personal data was unlawfully retained after she left the organization.
Who was affected
The individual who previously belonged to Jehovah's Witnesses and wanted her data erased.
What the authority found
The court held that the organization could lawfully retain historical data about former members under specific legal provisions.
Why this matters
This case sets a precedent for how organizations can manage sensitive data of former members. Companies should understand the legal bases for retaining personal data, especially for sensitive information.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The data subject is a former member of Jehovah's Witnesses (the controller). She left the organisation in 2020. The data that the controller has collected during the time of her membership was retained by the controller after her exit. The data subject decided to lodge a complaint against the controller claiming that, # the processing does not have a lawful basis under the GDPR and, # the controller did not allow for her exercise of right to be forgotten under Article 17 GDPR as they did not erase her data from their data base and did not return physical documents containing her personal data. The complaint was rejected by the DPA. The case was later lodged with the Administrative Court and was decided in favour of the controller. The data subject lodged an appeal with the Supreme Administrative Court. The Polish Supreme Administrative court did not revisit all the facts of the case, but only specific errors raised by the data subject. The cassation appeal was rejected in its entirety due to the fact, that, 1) the data subject did not specify which specific subsection of Article 9 GDPR is supposed to be violated and therefore is the legal basis of the appeal and, 2) the factual nature of the appeal was incorrect, as the data subject claimed Article 9 GDPR cannot be fulfilled, as she never consented for processing. The Supreme Administrative Court has expressed or affirmed the following: # Processing of historical data of a former member of a religious organisation may be lawful under Article 6(1)(f) GDPR and does not have to be based on consent Article 6(1)(a) GDPR. # As the data is sensitive within the meaning of Article 9 GDPR, such processing of historical data of a former member will be lawful under Article 9(2)(d) GDPR (the internal processing by certain organisations), subject to appropriate technical safeguards. # Data regarding former members which relate to ongoing court proceedings should be processed on the basis of Article 9(2)(f) GDPR (exercise or
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case III OSK 769/23 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case III OSK 769/23 - Poland (2024). Retrieved from cookiefines.eu
Last updated: