Access hindering and failure to provide the President of the PL SA with the necessary information

Access hindering and failure to provide the President of the Personal Data Protection Office with the necessary information may result in an administrative fine

The President of the Personal Data Protection Office, Mirosław Wróblewski, imposed an administrative fine of PLN 18 941 on a gastronomic entrepreneur for failing to provide access to all personal data and to provide the information necessary for the President of the Personal Data Protection Office for carrying out his tasks.

The case concerns a complaint to the President of the Personal Data Protection Office lodged by a individual in 2021 about irregularities in the processing of his or her personal data by an entrepreneur from Silesia voivodeship. That was the processing of the complainant’s biometric data by the employer.

In the course of the examination of the case itself, the President of the Personal Data Protection Office found that the entrepreneur, as employer, acted in relation to the complainant as controller and obtained her personal data (including probably fingerprints).

The President of the Personal Data Protection Office therefore called on the entrepreneur to comment on the content of the complaint and to provide explanations on the legal basis on which it processed (or processes) the biometric data of the complainant; the questions also referred to the duration of the possible processing, the appropriateness of such an action and the obligation to provide information that should be fulfilled to the data subjects whose data are processed.

The entrepreneur did not provide any explanation in the case. With reference to further letters asking for clarifications (the last of May 2024), the President of the Personal Data Protection Office did not receive any reply from the entrepreneur. The entrepreneur was also informed that failure to respond fully to the request of the data protection authority may result in the imposition of an administrative fine, in accordance with Article 83 (5)(e) GDPR.

Therefore, the President of the Personal Data Protection Office initiated ex officio proceedings for the imposition of an administrative fine for an infringement of Article 58 (1)(a) and (e) GDPR. The entrepreneur was informed of the opening of the proceedings in January 2025 and was requested to provide the information necessary to determine the amount of the fine. Once again, he was given the opportunity to be heard, which could have an impact on the amount of the fine imposed.

However, the entrepreneur did not take any action with regard to the proceedings. The persistent failure of the entrepreneur to reply was considered an obstacle to an objective, thorough and comprehensive examination of the case. Therefore, the President of the Personal Data Protection Office considered that there were grounds justifying the imposition of an administrative fine on the entrepreneur for an infringement consisting in failure to provide information and to provide access to all personal data and information necessary for the performance of its tasks. 

In view of the President of the Personal Data Protection Office, there has been a conscious and deliberate lack of willingness on the part of the entrepreneur to cooperate – resulting in an unjustified extension of the complaint proceedings conducted by the President of the Personal Data Protection Office and the continuation of the infringement by the entrepreneur, which has an impact on the assessment of the infringement.

Decision in Polish: DKE.561.1.2025