The President of the Personal Data Protection Office to Re examine the Case of the Disclosure

The President of the Personal Data Protection Office to Re‑examine the Case of the Disclosure of a Doctor’s Personal Data by the Minister of Health

The President of the Personal Data Protection Office will once again examine the case concerning the fine imposed on the Minister of Health for disclosing a doctor’s personal data. The VoivodeshipAdministrative Court in Warsaw held that the decision of the President of the Personal Data Protection Office should take into account the findings of the criminal court.

The case, which the supervisory authority will now revisit, dates back to December 2023, when the President of the Personal Data Protection Office imviposed an administrative fine of PLN 100,000 on the Minister of Health. Acting as the controller of data processed in an electronic system, the Minister obtained data from that system and subsequently published it on a social media platform. The post contained information about a doctor who had issued a pro auctore prescription (for personal use) for a psychotropic medicine. Following administrative proceedings, the President of the Personal Data Protection Office found that the data had been disclosed without a legal basis, which resulted in the imposition of the administrative fine.

On 2 March 2026, a hearing in the case was held before the VoivodeshipAdministrative Court in Warsaw. In its oral reasoning, the Court referred to its obligation to follow the final judgment of the criminal court issued in September 2025 in connection with the parallel criminal proceedings against Adam Niedzielski. According to that judgment, Adam Niedzielski, acting as a public official – the minister responsible for health – exceeded his powers by disclosing, via mass communication channels and in circumstances where it was not permissible, information obtained from the Medical Information System in the form of personal data relating to health, contrary to Article 9(1) and (2) of the GDPR. He had accessed this information in the course of performing his official duties (as the minister responsible for health). In the view of the VoivodeshipAdministrative Court, the criminal court’s judgment of September 2025 affected the assessment of the facts described in the contested decision of December 2023. For this reason, the Court decided to annul that decision in order to allow the supervisory authority to reconsider the case in light of the findings made by the criminal court.