Election Committee of Karol Nawrocki breached the GDPR by making personal data publicly available

The case concerns the disclosure of personal data recorded in a sale contract of an apartment and a handwritten will. The President of the Personal Data Protection Office, Mirosław Wróblewski, found a breach of the provisions of the GDPR and imposed an administrative fine of PLN 35 582 on the Election Committee of the candidate for the President of the Republic of Poland, Karol Nawrocki.

During the 2025 presidential election campaign, allegations were made that the presidential candidate had questionably acquired an apartment from an older citizen. While defending the candidate, MP Przemysław Czarnek attended the press conference, disclosed and presented the content of documents directly related to the transaction. These were: a preliminary sale contract of an apartment, a power of attorney and a will. The documents contained, inter alia, personal data relating to: the names of the parties to the contract; parents’ first names, personal identification numbers (PESEL), numbers and series of identity cards, residential addresses, information on family circumstances, and the method of disposing of assets.

These included personal data of the candidate for President of the Republic of Poland, but also two persons who did not perform public functions (the owner of the apartment and the candidate’s wife). The former certainly did not consent to his data being discosed.

The disclosure took place on 6 May 2025 at the Law and Justice party premises at the following party Members’ press conference: Przemysław Czarnek, Paweł Szefernaker and Andrzej Śliwka. The documents were presented and discussed by MP Przemysław Czarnek.

The President of the Personal Data Protection Office asked the MP to explain on what legal basis he had done so, from what source and for what purpose he had obtained the personal data he had disclosed.

The MP’s representative pointed out that Przemysław Czarnek had no intention of ‘disclosing any personal data appearing on the documents’. The MP himself added that he had received the documents from the organisers of the conference, who had ‘instructed him to present at the press conference the real circumstances of the events in the election campaign’.

In the light of the explanations provided by MP Przemysław Czarnek, the President of the Personal Data Protection Office requested clarification from the Election Committee of the candidate for President of the Republic of Poland. The latter confirmed the MP’s explanations, but disagreed with the claim that personal data of non-public figures had been disclosed during the conference.

In those circumstances, the President of the Personal Data Protection Office initiated administrative proceedings concerning the breach by the Election Committee of the President of the Republic of Poland, the controller of the personal data disclosed at the conference, of its obligations under Article 5(1a) and Article 6 (1) of the GDPR. In connection with the disclosure without a legal basis of the personal data of two non-public office holders. Personal data have been captured by, among others, television cameras – documents have not been anonymised before.

Karol Nawrocki’s Election Committee argued that the personal data on the owner of the apartment were already known beforehand, circulated online in material reaching great extent and was available to the average internet user.

However, the President of the Personal Data Protection Office, Mirosław Wróblewski, noted that the first name and surname could be found on the web, but not the other personal data of the citizen. The public availability of part of the personal data is not a decisive argument for the lawfulness of the processing of data disclosed at a press conference. There is no evidence that the owner of the apartment has previously published the data himself or that he has consented to such publication. However, at the time of their disclosure at the conference, data subject lost control of his data.

The Election Committee pointed out that the issues raised at the press conference were related to the media discussion about the “one-room apartment” purchased by the presidential candidate. Those circumstances were therefore of particular interest to the public. Therefore, the disclosure of those data was part of the media debate and electoral debate. This was intended to counterbalance the negative opinions expressed vis-à-vis the presidential candidate, which could have an impact on the final outcome of the elections.

The President of the Personal Data Protection Office indicated that the disclosure of personal data of two non-public persons could not be considered as an activity dictated by the needs of the election campaign. He acknowledged that he understood the seriousness of the charges against the candidate. He also disagreed that anonymised documents alone would not be sufficient to refute the allegations. It is true that documents can and must have been anonymised. The additional data disclosed did not in themselves present any specific informative value relevant to the objectives of the press conference.

The GDPR explicitly refers to grounds that legitimise the processing of personal data (e.g. obtaining consent from the data subject; compliance with a legal obligation by the controller or performance of a task carried out in the public interest). In the present case, none of the conditions laid down in the GDPR legalised the disclosure, at a press conference, of the personal data of the owner of the apartment or of the wife of the candidate for the President of the Republic of Poland. The Election Committee has not demonstrated, in the course of the proceedings, that such a basis exists in respect of any of those persons, despite the controller’s obligation to do so under the principle of accountability enshrined in the GDPR.

The President of the Personal Data Protection Office also points out that, by assuming the precedence of the interests of the candidate for the President of the Republic of Poland, Karol Nawrocki, the Election Committee, acting on his behalf, did not take into account the consequences of the publication of the data for the other persons concerned.

At the same time, the priority of the candidate’s interests is not supported by any analysis showing that his interests prevail. There is no doubt that the disclosure of the apartment owner’s personal data constituted an extremely strong and totally unnecessary interference with his right to privacy.

As regards the amount of the fine imposed, under the GDPR, it can amount to up to EUR 20 million and, in the case of a company, up to 4 % of the total worldwide annual turnover of the preceding financial year. When determining the amount of the administrative fine in this case, the President of the Personal Data Protection Office applied the methodology adopted by the EDPB in its Guidelines 04/2022.

The amount of the administrative fine imposed is PLN 35 582.

In the opinion of the President of the Personal Data Protection Office, the fine imposed fulfils the functions of a fine laid down in the GDPR (Article 83(1) of the GDPR) and represents the most adequate and, above all, fair response to the identified breach of the GDPR. The imposition of an administrative fine of a fixed amount is necessary and justified by the nature, gravity and other circumstances of the case. The application of another corrective measure provided for in Article 58(2) GDPR, and in particular the mere reprimand – in the event of its prior application in connection with another beach of the provisions of the GDPR attributed to the Election Committee for the President of the Republic of Poland – would not be proportionate to the irregularities found.

It should be recalled that in 2025, the President of the Personal Data Protection Office initiated proceedings against Karol Nawrocki’s Election Committee. The topic of the ‘one-bedroom apartment’ was also used by Rafał Trzaskowski’s Election Committee, which was also met with the initiation of proceedings by the President of the Personal Data Protection Office. That committee was issued a reprimand for  disclosing the name of the owner of the apartment and the details of the place where he resided. As a result of the proceedings initiated, the Election Committee of Karol Nawrocki was also issued a reprimand by the President of the Personal Data Protection Office for the disclosure of personal data in a video on Youtube.pl containing information on the private life of the owner of the apartment, his state of health, family and financial problems and his legal problems. The Committee was also ordered to remove this material. The fine currently imposed by the President of the Personal Data Protection Office is therefore the result of the action of Karol Nawrocki’s Electoral Committee in the context of a repeated breach of the provisions on the protection of personal data, which had to be met with a firm response from the supervisory authority.

Decision in Polish: DKN.5131.12.2025