The National Public Prosecutor's Office (Prokuratura Krajowa) – €19,550 Fine (Poland, 2024)

A press conference was organized by the National Public Prosecutor's Office (Prokuratura Krajowa), the controller. During the conference, the controller’s employee disclosed the facts of the case and personal data of injured person (a data subject) involved in criminal proceedings before one of regional courts in Poland. The employee read fragments of the final ruling. The disclosed data amounted to name, surname, the status of injured party, the criminal offence suffered by the data subject, data concerning health. A third-party informed the Polish DPA (UODO) about the incident. The DPA started ex officio proceedings. Neither the DPA nor the data subject were informed about the incident by the controller. The controller explained the personal data disclosed during the press conference were heard in proceedings in court. Hence, the data were already known to the public. The controller processed the data referring to the criminal proceedings at hand in order to verify basis for potential extraordinary appeal (skarga nadzwyczajna) by the Attorney General (Prokurator Generalny). The controller quoted Article 12 para 2 of [https://isap.sejm.gov.pl/isap.nsf/DocDetails.xsp?id=WDU20160000177 the Law on Public Prosecutors] (Prawo o prokuraturze) ) to be a legal basis for disclosure of information referring to activities of public prosecutors, to media and public opinion. According to the controller the aforementioned provision excluded from disclosure only classified information, and the data at hand were not of that kind. Moreover, the controller claimed the GDPR was not applicable, since the main activity of the public prosecutors was covered by provisions of [https://isap.sejm.gov.pl/isap.Nsf/download.xsp/WDU20190000125/U/D20190125Lj.pdf the Law on data protection for the purposes of the prevention and prosecution of criminal] offence (Ustawa o ochronie danych osobowych przetwarzanych w związku z zapobieganiem i zwalczaniem przestępczości). The DPA found the controller violated Article 5(1)(a) GDPR, Article 6(1) GDPR, Article 9 GDPR, Article 33(1) GDPR, Article 34(1) GDPR and Article 34(2) GDPR. The controller organised the press conference to inform the public opinion about changes to personnel working within one of the public prosecutor’s office of lower instance. Allegedly, the public prosecutors involved in the criminal proceedings at hand failed to proceed it properly. The disclosure of the data subject’s data was then not a part of criminal offences’ prosecution, being the main activity of public prosecutors under the Law on Public Prosecutors. Thus, the GDPR was applicable. Due to the their nature, the personal data disclosed during the press conference were classified as special categories of data under Article 9(1) GDPR. Whilst the controller indicated Article 12 para 2 of Law on Public Prosecutors as a legal basis of processing, it refers to ongoing examination proceedings or to the main activity of the public prosecutors. None of them was identified by the DPA during the investigation. Besides, to rely on Article 12 para 2 of Law on Public Prosecutors the controller was obliged to authorise an employee to discuss the details of criminal proceedings. Nevertheless, the controller didn’t inform the DPA whether the employee was authorised and by whom. The DPA found then the controller processed the data unlawfully. As a result, the controller violated Article 6(1) GDPR and Article 9 GDPR, and additionally Article 5(1)(a) GDPR. For the DPA, the disclosure of the data during the press conference was a data breach. The press conference was streamed online and in the TV and the data contained sensitive information. Because of that, the disclosure posed a high risk to rights and freedoms of the data subject. Consequently, the controller was obliged to notify the breach to the DPA and the data subject. However, the controller didn’t find a reason to analyse the disclosure under Article 33(1) and Article 34(1) GDPR. That led to violation of both provisions. In conclusion, the DPA imposed a fine of PLN 85,000 (approximately €19,800) and ordered the controller to notify the data breach to the data subject under Article 34(2) GDPR within 3 days.