The President of the Personal Data Protection Office appealed against the judgment of the Voivodeship Administrative Court in the case of Poczta Polska to the Supreme Administrative Court

The decision of the Prime Minister cannot be regarded as the legal basis for the processing of data by Poczta Polska (the Polish Post) – this is the main objection of the President of the Personal Data Protection Office, Mirosław Wróblewski, to the judgment of the Voivodeship Administrative Court in Warsaw, which annulled the decision of the supervisory authority in so far as it concerned that company.

In his cassation appeal  to the Supreme Administrative Court against the judgment of the Voivodeship Administrative Court in Warsaw, the President of the Personal Data Protection Office pointed out that the position of the Voivodeship Administrative Court was based on the erroneous identification of two separate legal categories: the effectiveness of the individual administrative decision vis-à-vis the addressee and the existence of a basis for the processing of personal data required by Art. 6(1) and 6(3) GDPR. The President of the Personal Data Protection Office pointed out that even if the decision of the Prime Minister—pursuant to which Poczta Polska processed citizens’ data for the purpose of conducting correspondence elections—formally remained in force, it did not constitute a legal basis within the meaning of Article 6(3) of the GDPR. An individual administrative act, that is to say, a decision, cannot be regarded as a rule of national law. This means that the existence of the Prime Minister's decision related to the holding of correspondence elections did not give the Polish Post a basis for processing citizens' data, which was transferred to the company by the then Ministry of Digital Affairs.

A specific provision, not a decision

In his appeal in cassation to the Supreme Administrative Court, the President of the Personal Data Protection Office pointed out that if the condition for legalising the processing is Art. 6(1)(c) GDPR, i.e. compliance with a legal obligation to which the controller is subject, is in accordance with Art. 6(3). The basis for this processing must be laid down in EU law or in the Member State law to which the controller is subject. The purpose of the processing must also be specified by law.

In the grounds for the appeal against the judgment of the Voivodeship Administrative Court, the President of the Personal Data Protection Office recalled the judgment of the Supreme Administrative Court of 13 March 2024 (ref. II OSK 1630/21), in which the Court expressly stated that ‘the decision of the Prime Minister as an individual and specific act cannot be regarded as a source of substantive competence. Only normative acts listed in Article 87 of the Constitution of the Republic of Poland may constitute a source of competence for the performance of public tasks, the effects of which shape the legal situation of addressees outside the system of public authority.’

The Poczta Polska could act differently

In the cassation appeal, the supervisory authority pointed out that the company had the opportunity to oppose the order resulting from the Decision of the Prime Minister. It could apply to the authority that issued the decision for a re-examination of the case, to which it was entitled under the provisions of the Code of Administrative Procedure. It could also request that the decision be supplemented as to its outcome or that doubts as to the content of the decision be clarified. However, the Polish Post did not exercise any of those powers, even though it had doubts as to the compliance of the Prime Minister’s instruction with the law in force at the time.

In the opinion of the supervisory authority, the company was also not only a passive, technical contractor of someone else's activity, but independently took actions leading to the acquisition and further processing of personal data. In addition, the infringement consisted not in the failure to lodge an appeal against the decision of the Prime Minister, but in the actual processing of data without a legal basis.

The President of the Personal Data Protection Office also disagrees with the assessment of the Voivodeship Administrative Court in Warsaw that he did not carry out a proper analysis of the facts in the present case. On the contrary. He made an extensive and thorough assessment of all the relevant aspects of this case, taking into account the sequence of events. In support of the complaint to the Supreme Administrative Court, the authority accurately reproduced the course of the proceedings and the findings made during the proceedings.

In his complaint to the Supreme Administrative Court, the President of the Personal Data Protection Office requested that the judgment of the Voivodeship Administrative Court be set aside in its entirety.

Case history

The whole matter begins in 2020, when attempts were made to organize the election for the office of the President of the Republic of Poland exclusively by correspondence due to the COVID-19 pandemic. The authorities have started organising the electoral process in this form, despite the fact that the law amending the election rules has not yet entered into force. This law, which was not in force in April 2020, assumed that Poczta Polska would deliver electoral packages printed by the State Securities Printing House to voters' mailboxes, and voters would cast their votes by correspondence in order not to gather in person at polling stations.

On 16 April 2020, by an administrative decision, the Prime Minister ordered Poczta Polska to prepare for the correspondence elections of the President of the Republic of Poland. Citing this instruction, Poczta Polska requested on 20 April 2020 to be provided for this purpose with data from the PESEL database of approximately 30 million Polish citizens who were supposed to be of legal age and residing in Poland on the day of the planned elections.

The Minister of Digital Affairs gave his approval, and the data stored on the DVD was delivered (made available) to Poczta Polska on April 22, 2020, and was processed by Poczta Polska.

The personal data of around 30 million Polish citizens were only erased between 15 and 22 May 2020, after it turned out that the elections on 10 May 2020 would not take place.

We encourage you to read the press release: Administrative fines for GDPR infringement during correspondence elections in 2020 , in which we discuss the decision of the President of the UDOO (in Polish), in which the supervisory authority imposed on Poczta Polska an administrative fine of over PLN 27 million.