Minister of Digitalisation of Poland – €6,238,708 Fine (Poland, 2025)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
In April 2020, the Polish Prime Minister decided to hold elections for the President of the Republic of Poland by postal voting. He instructed the Polish Post S.A. (Post) to prepare the organisation for the elections. The Post requested from the Minister of Digitalisation (Minister) citizens personal data collected in the Register of the Universal Electronic Population Registration System (PESEL Register) for the purpose of creating a database of voters' addresses for the delivery of packages. The Minister provided the personal data of approximately 30 million people. More specifically; the PESEL number (a unique 11-digit identifier), the first names, the surnames, the last current address of permanent residence registration, the address of temporary residence registration, as well as the currently registered temporary departure outside the country of all living persons of legal age with a registered Polish citizenship. The Post continued to process the data for the purposes of the organisation of the general election up until their deletion in May 2020. In April 2020, the Ombudsman for Civil Rights Protection filed a complaint to the Provincial Administrative Court of Warsaw (WSA) against the aforementioned decision of the Polish Prime Minister and in May 2020 against the Minister's action to provide the personal data. Following the complaints, the WSA, in 2021, and the Supreme Administrative Court of Poland (NSA), in 2024, issued their final judgments. They declared the Minister's action of April 2020 to provide the Post with access to personal data from the PESEL register ineffective. Both courts held that there was no legal basis under polish law for conducting the 2020 presidential election exclusively by correspondence and therefore no legal basis for issuing an order that would oblige one to take steps to prepare to carry them out. Also, the courts stated that the Post and the Minister were obliged to verify whether the request of the Prime Minister was
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
Entities Involved
In April 2020, the Polish Prime Minister decided to hold elections for the President of the Republic of Poland by postal voting. He instructed the Polish Post S.A. (Post) to prepare the organisation for the elections. The Post requested from the Minister of Digitalisation (Minister) citizens personal data collected in the Register of the Universal Electronic Population Registration System (PESEL Register) for the purpose of creating a database of voters' addresses for the delivery of packages. The Minister provided the personal data of approximately 30 million people. More specifically; the PESEL number (a unique 11-digit identifier), the first names, the surnames, the last current address of permanent residence registration, the address of temporary residence registration, as well as the currently registered temporary departure outside the country of all living persons of legal age with a registered Polish citizenship. The Post continued to process the data for the purposes of the organisation of the general election up until their deletion in May 2020. In April 2020, the Ombudsman for Civil Rights Protection filed a complaint to the Provincial Administrative Court of Warsaw (WSA) against the aforementioned decision of the Polish Prime Minister and in May 2020 against the Minister's action to provide the personal data. Following the complaints, the WSA, in 2021, and the Supreme Administrative Court of Poland (NSA), in 2024, issued their final judgments. They declared the Minister's action of April 2020 to provide the Post with access to personal data from the PESEL register ineffective. Both courts held that there was no legal basis under polish law for conducting the 2020 presidential election exclusively by correspondence and therefore no legal basis for issuing an order that would oblige one to take steps to prepare to carry them out. Also, the courts stated that the Post and the Minister were obliged to verify whether the request of the Prime Minister was
Related Enforcement Actions (0)
No other enforcement actions found for Minister of Digitalisation of Poland in PL
This is the only recorded action for this entity in this jurisdiction.
Details
Fine Date
17 March 2025
Authority
Urząd Ochrony Danych Osobowych
Fine Amount
€6,238,708
27,124,816 PLN
GDPRhub ID
gdprhub-9253About this data
Cite as: Cookie Fines. Minister of Digitalisation of Poland - Poland (2025). Retrieved from cookiefines.eu
Last updated: