Court case III OSK 4868/21 – Court Ruling (Poland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A Polish bank was warned for ignoring a couple's request to stop sending them marketing materials and bank statements after they withdrew their consent. This case is important because it shows that companies must respect users' wishes regarding their personal data. Ignoring such requests can lead to legal issues and damage customer relationships.
What happened
The bank continued to process the couple's data for marketing despite their request to stop.
Who was affected
The husband and wife who opened a personal bank account were affected.
What the authority found
The Polish authority found that the bank unlawfully processed the couple's data and did not comply with their request to stop sending communications.
Why this matters
This case reinforces the need for businesses to honor customer requests regarding their data. Companies should have clear processes to manage consent and ensure they stop unwanted communications when asked.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
A husband and a wife (data subjects) opened a personal bank account with a bank (the controller). The controller processed inter alia their name, surname, personal identification number (PESEL), address, phone number, martial status. After changing the account type, the data subjects requested the controller, in writing, to stop sending advertising material and bank statements on their address; also, they withdrew the consent for data processing. The consent had covered data processing, including archiving personal data by the controller. The controller refused to comply with the request, claiming they were unable to identify the senders of the request. The data subjects were asked to use an online service, the helpline or file the request in person. The controller explained the bank statements referred to data subjects’ account. The data subjects refused to use one of communication channels suggested by the controller. Again, data subjects upheld their request and consent withdrawal. Although the controller closed the data subjects' account and claimed to cease processing of their data, the data subjects received another mail with bank statements and information about new deposit accounts. In one of the letters sent to data subjects, the controller informed them, that the processing was based on controller’s legitimate interest to establish, exercise or defend legal claims i.e. Article 6(1)(f) GDPR. The data subject filed a complaint with the Polish DPA (UODO). The DPA found the controller didn’t comply with the data subjects’ request (treated by the DPA as objection under Article 21 GDPR) and unlawfully processed their data for marketing purposes. Hence, the DPA issued a warning to the controller for violation of Article 6(1) GDPR, Article 12(2) GDPR, Article 12(3) GDPR, Article 21(3) GDPR. Moreover, the DPA ordered deletion of data subjects’ data. The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyj
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case III OSK 4868/21 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Court case III OSK 4868/21 - Poland (2025). Retrieved from cookiefines.eu
Last updated: