President of the Personal Data Protection Office responds to unjustified disclosure of personal data

Due to significant public interest in the issue of personal data disclosure by politicians, we inform you that the President of the Personal Data Protection Office is analysing such cases and taking action within the scope of his authority.

Yesterday, the Office published an appeal by the President of the Personal Data Protection Office  Mirosław Wróblewski addressed to politicians, urging them not to forget the importance of respecting personal data protection principles and to refrain from disclosing citizens’ data. Such disclosure can have far-reaching negative consequences for the affected individuals due to the vast reach of election campaigns and the potential for the disclosed data to be widely amplified, especially in the digital sphere. We encourage everyone to read the appeal on the Office’s website: https://uodo.gov.pl/pl/138/3688

It is worth noting that, in the same context, the President of the Personal Data Protection Office also reminded the public of data protection principles during election campaigns in a statement issued on May 7 of this year (https://uodo.gov.pl/pl/138/3673).

We also emphasise that anyone who decides to make someone’s personal data public along with commentary (e.g., online, at a press conference, etc.) must be aware that such an action may primarily result in a violation of personal rights, which may lead to legal claims for the protection of those rights under the provisions of the Civil Code (according to Article 23 of the Civil Code, a person’s personal rights, such as name, pseudonym, or image, are protected by law).

It should be noted that while the disclosure of personal data constitutes a personal data breach , not every such act requires notifying the supervisory authority or initiating ex officio proceedings.

In the case of the disclosure of a citizen’s personal data (name and surname) by Mr Rafał Trzaskowski, the President of the Personal Data Protection Office will initiate ex officio proceedings. Similarly, he will pursue the case of the same citizen’s data being disclosed in a video interview by Mr Karol Nawrocki (name, surname, current address). While the disclosed data do not, by themselves, constitute special category of data, however the contextual information (e.g., address) and the widespread interest of traditional, digital, and social media have led to this individual’s identity and life situation becoming widely known. In the view of the President of the Personal Data Protection Office, these are exceptional circumstances, and therefore he has decided to launch proceedings regarding the data disclosures made by both candidates for the office of the President of Poland.

The risks stem not only from the content of the statements but also from their context. Among the information disclosed about the mentioned citizen were details about health status, legal issues, and personal circumstances related to finances and family. In numerous public appearances, handwritten letters have also been read aloud or shown. All of this undoubtedly infringes the privacy of this individual.

We also remind that on May 7 of this year, the President of the Personal Data Protection Office decided to initiate ex officio proceedings regarding the disclosure of personal data during a press conference held by PiS MP Przemysław Czarnek, along with PiS MPs Paweł Szefernaker and Andrzej Śliwka. In this case, the data of two individuals were disclosed in the most extensive manner – the Member of Parliament revealed names, surnames, parents’ names, Personal Indetification Number (PESEL number), registration numbers, ID card numbers and series, NIP numbers (Taxpayer ID No.), and home addresses. MP P. Czarnek was required by the President of the Personal Data Protection Office to provide explanations in a letter dated May 9.

In light of recurring incidents suggesting problems with compliance with data protection regulations, the President of the Personal Data Protection Office - aside from the Office’s own educational efforts and published guidance - plans to propose, after the current campaign ends, training sessions on data protection principles for parliamentary offices and political parties’ caucuses, to be coordinated with the Speaker and the Chancellery of the Sejm. Similar training will also be offered under the cooperation established last year between the President of the Personal Data Protection Office and the National Electoral Office.

At the same time, we would like to acknowledge that the vast majority of journalists have effectively anonymised the personal data disclosed by politicians in their reporting. We are very pleased with this responsible approach by the media, demonstrating their commitment to personal data protection.