Court confirmed legitimacy of the fine imposed on the Lower Silesian Football Association
By the judgment of 28th February 2020, the Voivodeship Administrative Court in Warsaw upheld the decision of the President of the Personal Data Protection Office imposing an administrative fine of PLN 55 750.50.
The Lower Silesian Football Association has made public personal data concerning referees, who were granted referee licenses. The data such as names, surnames, addresses of residence and personal identification (PESEL) numbers were disclosed. The President of the Personal Data Protection Office stated that there are no legal bases for such a broad scope of referees’ data being available on the Internet.
The Voivodeship Administrative Court shared the view of the President of the Personal Data Protection Office that the personal data processing should be guided by the data minimisation principle (Art. 5(1)(c) of the GDPR).
In addition, the Voivodeship Administrative Court supported the Supervisory Authority’s argument that publishing data such as name, surname, address of residence and PESEL number can lead to far-reaching negative consequences for the data subjects. By publishing these data the controller was creating risk of their misuse, e.g. for the purpose of impersonating these individuals in order to raise a loan or to create other obligations.
The court did not agree with the argument of the applicant, who claimed that non-professional entities were exempted from applying the provisions on the protection of personal data while processing the data.