Court case III OSK 4984/21 – Court Ruling (Poland, 2024)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A court rendered a judgment in a case referring to a data subject. An individual, being a member of data subject’s family, published the judgement via their Facebook account and by placing its copy behind their car’s pane. The judgment was published in that way for 11 days. The data subject filed a complaint with the Polish DPA (UODO). The DPA dismissed the complaint as it considered that the personal data were published under Article 2(2)(c) GDPR, i.e. for purely personal activity. Additionally, the individual and the data subject were related. Thus, according to the DPA, the processing at stake fell outside GDPR’s scope of application. The data subject brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The court repealed the DPA’s decision. By referring to case C-101/01 and C-212/13, the court emphasised the exemption of purely private activity didn’t cover the processing which led to disclosing the data to unlimited number of people. Because the individual shared the data via Facebook, making it available to unlimited number of its users, Article 2(2)(c) GDPR didn’t apply. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court explained that the notion of purely personal activity was inherently limited. In particular, when the personal data were made accessible to an unrestricted number of people, for instance, social media users, it excluded the application of Article 2(2)(c) GDPR. The court based it reasoning on Recital 18 GDPR, case C-212/13 and WP29 [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2009/wp163_en.pdf Opinion 5/2009]. In the case at stake, the individual published the judgement referring to the data subject via Facebook. The post shared in such a way that every Facebook user could has accessed it. Hence, the indiv
GDPR Articles Cited
A court rendered a judgment in a case referring to a data subject. An individual, being a member of data subject’s family, published the judgement via their Facebook account and by placing its copy behind their car’s pane. The judgment was published in that way for 11 days. The data subject filed a complaint with the Polish DPA (UODO). The DPA dismissed the complaint as it considered that the personal data were published under Article 2(2)(c) GDPR, i.e. for purely personal activity. Additionally, the individual and the data subject were related. Thus, according to the DPA, the processing at stake fell outside GDPR’s scope of application. The data subject brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The court repealed the DPA’s decision. By referring to case C-101/01 and C-212/13, the court emphasised the exemption of purely private activity didn’t cover the processing which led to disclosing the data to unlimited number of people. Because the individual shared the data via Facebook, making it available to unlimited number of its users, Article 2(2)(c) GDPR didn’t apply. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court explained that the notion of purely personal activity was inherently limited. In particular, when the personal data were made accessible to an unrestricted number of people, for instance, social media users, it excluded the application of Article 2(2)(c) GDPR. The court based it reasoning on Recital 18 GDPR, case C-212/13 and WP29 [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2009/wp163_en.pdf Opinion 5/2009]. In the case at stake, the individual published the judgement referring to the data subject via Facebook. The post shared in such a way that every Facebook user could has accessed it. Hence, the indiv
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case III OSK 4984/21 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case III OSK 4984/21 - Poland (2024). Retrieved from cookiefines.eu
Last updated: