The Voivodeship Administrative Court in Warsaw dismisses Ujastek Medical Centre’s complaint

The Voivodeship Administrative Court in Warsaw dismisses Ujastek Medical Centre’s complaint against the decision of the President of the Personal Data Protection Office

The Voivodeship Administrative Court in Warsaw has dismissed the complaint lodged by Ujastek Medical Centre concerning the decision of the President of the Personal Data Protection Office, which imposed two administrative fines totalling PLN 1,145,891.25. The company was penalised for installing image‑recording devices in two rooms of the neonatal ward in breach of the law, and for failing to apply security measures appropriate to the risks associated with data stored on memory cards in monitoring devices.

The fines against the Kraków‑based Ujastek Medical Centre were imposed on 17 January 2025 by Mirosław Wróblewski, the President of the Personal Data Protection Office, we wrote about the matter: News and events - UODO

Between 1 and 23 July 2023, the video surveillance instaled in the neonatal ward recorded images showing both newborns and their mothers during intimate activities, such as breastfeeding and childcare. Neither patients nor staff were informed about the recording.

In response to the decision of the President of the Personal Data Protection Office, Ujastek Medical Centre filed a complaint with the Voivodeship Administrative Court in Warsaw, seeking to have the decision annulled in its entirety and to recover the costs of the proceedings. The company alleged that the President of the Personal Data Protection Office had breached procedural provisions which materially affected the outcome of the case, including Articles 7, 77(1), 80 and 107(3) of the Code of Administrative Procedure, by failing to take all necessary steps to establish the facts, by not collecting and examining all evidence comprehensively, and by making an arbitrary assessment of the evidence contrary to logic and life experience.

The company also raised allegations of breaches of substantive law that had an impact on the outcome of the case. It argued that Article 13(1) and (2) of the GDPR had been wrongly applied, as the obligation to inform data subjects was deemed not to have been fulfilled. It further claimed that Articles 24, 25 and 32 of the GDPR had been misapplied, as the company was found not to have implemented appropriate organisational and technical safeguards ensuring a level of security appropriate to the risks of processing data using external storage media.

Ujastek Medical Centre also challenged the application of Article 83(1–5) of the GDPR, arguing that the fines imposed were disproportionate to the circumstances of the case. In its view, the fine should not have been imposed separately, as all alleged infringements of the GDPR should have been considered part of the same or related processing operations within the meaning of Article 83(3) of the GDPR.

The Voivodeship Administrative Court in Warsaw ruled that the complaint was unfounded.

In the Court’s assessment, the supervisory authority had correctly applied substantive law and rightly concluded, on the basis of the evidence gathered, that the infringements of the GDPR identified in the administrative decision had occurred. The Court held that provisions of the Act on Medical Activity and the Regulation of the Minister of Health of 26 March 2019, as well as Article 22 of the Labour Code, cited by the company, could not serve as a legal basis in this case.

Consequently, the Court upheld the position of the President of the Personal Data Protection Office that unlawful processing of personal data, including special category of data, had taken place through the use of video surveillance in hospital rooms. The Court also agreed with the supervisory authority that Ujastek Medical Centre had failed to meet its information obligations and had breached provisions relating to the implementation of security measures. The Court rejected the company’s argument that the number of individuals affected was small, noting that the company itself admitted that the data of 190 people had been compromised.

The Voivodeship Administrative Court in Warsaw further dismissed the company’s allegations that the President of the Personal Data Protection Office had breached procedural rules by misrepresenting the facts or arbitrarily assessing the evidence. It also disagreed with the claim that two separate fines had been wrongly imposed, finding that the amount of the penalties was justified.

In conclusion, the Court held that the contested decision did not breach procedural or substantive law to an extent that would justify its annulment, and therefore dismissed the complaint of Ujastek Medical Centre.