- Enforcing jurisdiction
- Poland · Geography does not establish applicable law.
- Confirmed applicable legislation
- Privacy topics
Court case III OSK 4868/21 – Court Ruling (Poland, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
A Polish bank was warned for unlawfully processing personal data after a couple requested to stop receiving marketing materials. This case highlights the importance of respecting user requests regarding their data. Companies should ensure they have clear processes for handling such requests.
What happened
A bank unlawfully processed personal data for marketing purposes despite a couple's request to stop.
Who was affected
The affected individuals were a husband and wife who opened a personal bank account with the bank.
What the authority found
The Polish DPA found that the bank did not comply with the couple's request to cease processing their data, violating GDPR.
Why this matters
This case serves as a reminder that businesses must respect users' rights to control their personal data. Companies should have clear procedures in place to address user requests effectively.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Linked-source text retrieved.
Automated check recorded — 22 March 2026.
Processing notes: articles corrected, authority corrected.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A husband and a wife (data subjects) opened a personal bank account with a bank (the controller). The controller processed inter alia their name, surname, personal identification number (PESEL), address, phone number, martial status. After changing the account type, the data subjects requested the controller, in writing, to stop sending advertising material and bank statements on their address; also, they withdrew the consent for data processing. The consent had covered data processing, including archiving personal data by the controller. The controller refused to comply with the request, claiming they were unable to identify the senders of the request. The data subjects were asked to use an online service, the helpline or file the request in person. The controller explained the bank statements referred to data subjects’ account. The data subjects refused to use one of communication channels suggested by the controller. Again, data subjects upheld their request and consent withdrawal. Although the controller closed the data subjects' account and claimed to cease processing of their data, the data subjects received another mail with bank statements and information about new deposit accounts. In one of the letters sent to data subjects, the controller informed them, that the processing was based on controller’s legitimate interest to establish, exercise or defend legal claims i.e. Article 6(1)(f) GDPR. The data subject filed a complaint with the Polish DPA (UODO). The DPA found the controller didn’t comply with the data subjects’ request (treated by the DPA as objection under Article 21 GDPR) and unlawfully processed their data for marketing purposes. Hence, the DPA issued a warning to the controller for violation of Article 6(1) GDPR, Article 12(2) GDPR, Article 12(3) GDPR, Article 21(3) GDPR. Moreover, the DPA ordered deletion of data subjects’ data. The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyj
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Court case III OSK 4868/21 in PL
This is the only recorded case for this entity in this jurisdiction.
Details
Ruling Date
8 January 2025
Authority
DPA WSAWarsaw
About this data
Cite as: Cookie Fines. Court case III OSK 4868/21 - Poland (2025). Retrieved from cookiefines.eu
Last updated: