Court case III OSK 769/23 – Court Ruling (Poland, 2024)

The data subject is a former member of Jehovah's Witnesses (the controller). She left the organisation in 2020. The data that the controller has collected during the time of her membership was retained by the controller after her exit. The data subject decided to lodge a complaint against the controller claiming that, # the processing does not have a lawful basis under the GDPR and, # the controller did not allow for her exercise of right to be forgotten under Article 17 GDPR as they did not erase her data from their data base and did not return physical documents containing her personal data. The complaint was rejected by the DPA. The case was later lodged with the Administrative Court and was decided in favour of the controller. The data subject lodged an appeal with the Supreme Administrative Court. The Polish Supreme Administrative court did not revisit all the facts of the case, but only specific errors raised by the data subject. The cassation appeal was rejected in its entirety due to the fact, that, 1) the data subject did not specify which specific subsection of Article 9 GDPR is supposed to be violated and therefore is the legal basis of the appeal and, 2) the factual nature of the appeal was incorrect, as the data subject claimed Article 9 GDPR cannot be fulfilled, as she never consented for processing. The Supreme Administrative Court has expressed or affirmed the following: # Processing of historical data of a former member of a religious organisation may be lawful under Article 6(1)(f) GDPR and does not have to be based on consent Article 6(1)(a) GDPR. # As the data is sensitive within the meaning of Article 9 GDPR, such processing of historical data of a former member will be lawful under Article 9(2)(d) GDPR (the internal processing by certain organisations), subject to appropriate technical safeguards. # Data regarding former members which relate to ongoing court proceedings should be processed on the basis of Article 9(2)(f) GDPR (exercise or defence of legal claims), however as the data subject did not raise this point in her appeal, the court could not examine this further. # Data of former members which is still necessary for the purpose of collection may be retained. In the case of the controller, data of former members are indispensable for realisation of statutory purposes. # The GDPR, specifically Article 17, does not bestow rights upon any enforcement organs, be it a court or a DPA, to demand a return of documents or copies of documents.