UODO (Poland) – Court Ruling (Poland, 2025)

A data subject filed a complaint with the Polish DPA (UODO) against a controller in May 2022. The DPA ordered the complaint to be supplemented by a description of alleged violations and expected actions to be taken by the DPA against the controller. In July 2022 the data subject filed another complaint, against another controller who allegedly unlawfully processed their data for marketing purposes. In November 2022 the DPA decided to join both proceedings initiated by the data subject. According to the DPA, the complaints referred to the same subject matter, namely unlawful phone number processing for marketing purposes. In April 2023, the DPA notified the parties that the examination proceedings were over, and the parties were entitled to present their position as to the collected evidence ([https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU19600300168/U/D19600168Lj.pdf Article 10(1) of the Code of Administrative Procedure - Kodeks postępowania administracyjnego]). In July 2023 the data subject issued a motion with the DPA to accelerate the proceedings. Afterwards, the data subject lodged a complaint against the DPA inactivity with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie - WSA Warszawie). In the meantime, in October 2023 the DPA issued a decision, closing the case at hand. The WSA Warsaw upheld the complaint. According to that court, Article 78(2) GDPR set forth a three-month term to examine the case. The DPA failed to do so. In particular, the court found the DPA took no action several times during the proceedings and that such an inactivity was not substantiated. The fact that the decision was eventually issued was irrelevant for the inactivity complaint. The DPA lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA). The Supreme Administrative Court dismissed the cassation appeal. The court emphasised that the scope of inactivity covered situations when a DPA exceeded the time given to examine a case. Under Article 78(2) GDPR the DPA was obliged to examine the case and issue a decision within 3 months. If the DPA knew the case required extensive examination proceedings, they were obliged to notify the data subject about the delay, inform them about the status of the case and indicate when the case would be closed. However, court held, that the DPA did not perform any of those actions. Thus, the cassation appeal was dismissed as unfounded.