Court case III OSK 4984/21 – Court Ruling (Poland, 2024)

A court rendered a judgment in a case referring to a data subject. An individual, being a member of data subject’s family, published the judgement via their Facebook account and by placing its copy behind their car’s pane. The judgment was published in that way for 11 days. The data subject filed a complaint with the Polish DPA (UODO). The DPA dismissed the complaint as it considered that the personal data were published under Article 2(2)(c) GDPR, i.e. for purely personal activity. Additionally, the individual and the data subject were related. Thus, according to the DPA, the processing at stake fell outside GDPR’s scope of application. The data subject brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The court repealed the DPA’s decision. By referring to case C-101/01 and C-212/13, the court emphasised the exemption of purely private activity didn’t cover the processing which led to disclosing the data to unlimited number of people. Because the individual shared the data via Facebook, making it available to unlimited number of its users, Article 2(2)(c) GDPR didn’t apply. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court explained that the notion of purely personal activity was inherently limited. In particular, when the personal data were made accessible to an unrestricted number of people, for instance, social media users, it excluded the application of Article 2(2)(c) GDPR. The court based it reasoning on Recital 18 GDPR, case C-212/13 and WP29 [https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2009/wp163_en.pdf Opinion 5/2009]. In the case at stake, the individual published the judgement referring to the data subject via Facebook. The post shared in such a way that every Facebook user could has accessed it. Hence, the individual’s data processing was not exempted from application of the GDPR.