Court case III OSK 4868/21 – Court Ruling (Poland, 2025)

A husband and a wife (data subjects) opened a personal bank account with a bank (the controller). The controller processed inter alia their name, surname, personal identification number (PESEL), address, phone number, martial status. After changing the account type, the data subjects requested the controller, in writing, to stop sending advertising material and bank statements on their address; also, they withdrew the consent for data processing. The consent had covered data processing, including archiving personal data by the controller. The controller refused to comply with the request, claiming they were unable to identify the senders of the request. The data subjects were asked to use an online service, the helpline or file the request in person. The controller explained the bank statements referred to data subjects’ account. The data subjects refused to use one of communication channels suggested by the controller. Again, data subjects upheld their request and consent withdrawal. Although the controller closed the data subjects' account and claimed to cease processing of their data, the data subjects received another mail with bank statements and information about new deposit accounts. In one of the letters sent to data subjects, the controller informed them, that the processing was based on controller’s legitimate interest to establish, exercise or defend legal claims i.e. Article 6(1)(f) GDPR. The data subject filed a complaint with the Polish DPA (UODO). The DPA found the controller didn’t comply with the data subjects’ request (treated by the DPA as objection under Article 21 GDPR) and unlawfully processed their data for marketing purposes. Hence, the DPA issued a warning to the controller for violation of Article 6(1) GDPR, Article 12(2) GDPR, Article 12(3) GDPR, Article 21(3) GDPR. Moreover, the DPA ordered deletion of data subjects’ data. The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyj