President of the PL SA initiates proceedings against MP Michał Woś and MEP Waldemar Buda

MP Michał Woś and MEP Waldemar Buda did not respond to letters from the supervisory authority requesting explanations regarding a personal data breach. Failure to provide information to the President of the Personal Data Protection Office, who is examining a potential violation of personal data protection law, constitutes an infringement of the GDPR and may result in a fine.

During the presidential election campaign, both deputies published posts containing details of an eviction case, including personal data of individuals who do not hold public office. Such personal data are protected under the GDPR and may only be made public when there is a legal basis for doing so. President of the Personal Data Protection Office Mirosław Wróblewski sought to determine whether the deputies had such a basis, but neither responded – they did not collect (with one exception) the letters sent to them twice and properly notified, addressed to their parliamentary offices. Their behaviour made it necessary for the President of the Personal Data Protection Office to initiate separate proceedings, which may result in sanctions. The primary aim of such actions is to ensure that data controllers provide the information required by the supervisory authority to conduct proper proceedings.

It must be emphasised that obstructing or preventing access to information requested by the supervisory authority from data controllers makes it impossible to examine the case and ensure legal protection for the data subjects. It also leads to excessive and unjustified delays in the proceedings, which contradicts fundamental principles of administrative procedure, such as diligence and promptness, as set out in the Code of Administrative Procedure. A controller who fails to provide the information necessary for the authority to carry out its tasks – namely, to issue a substantive decision in the case – breaches the obligation imposed on it by the provisions of the General Data Protection Regulation. When the President of the Personal Data Protection Office does not receive the information required from the controller to perform the tasks of the supervisory authority, a violation of the GDPR occurs.

Based on the circumstances of this case, the President of the Personal Data Protection Office also wishes to draw attention to the broader problem of controllers failing to collect correspondence addressed to them, in this instance sent to their parliamentary offices. This is a wider issue and does not concern only the deputies against whom the proceedings described here have been initiated.

Failure to collect correspondence is a serious problem. Particularly unacceptable are situations in which institutions or entities with established offices, secretariats, or mailrooms do not collect their mail. Such practices hinder the efficient handling of cases and the completion of proceedings conducted by the President of the Personal Data Protection Office, which in turn affects the effective protection of personal data.

It should also be understood that although failure to collect correspondence slows down the proceedings, it does not completely prevent the President of the Personal Data Protection Office from acting. The President may, for example, impose an administrative fine for lack of cooperation with the supervisory authority. Without information from the controller (which could potentially be to their benefit), the supervisory authority may decide the case based on the evidence available. Thus, the tactic of “burying one’s head in the sand” and ignoring information about proceedings conducted by the President of the Personal Data Protection Office may lead to tangible negative consequences.

Controllers – also in their own interest – should attach importance to collecting correspondence, both official and private. Some of these issues may be mitigated by the introduction of the e-delivery system, which obliges certain institutions to maintain an electronic mailbox, thereby facilitating effective and swift delivery of correspondence.