Opinion of the Advocate General — ECLI:EU:C:2024:162
Date: 2024-02-22
Language of the case: Polish

Summary C-693/22 – 1 
Case C-693/22 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged: 
10 November 2022 
Referring court: 
Sąd Rejonowy dla m.st. Warszawy w Warszawie (Poland) 
Date of the decision to refer: 
3 November 2022 
Applicant: 
I. sp. z o.o. 
Defendant: 
M.W. 
      
Subject matter of the main proceedings 
Action brought before the Sąd Rejonowy dla m.st. Warszawy w Warszawie 
(District Court for the Capital City of Warsaw in Warsaw (Poland)) by the 
applicant I. against the defendant M.W. for the payment of 59 040 zlotys (PLN) 
plus interest. 
Subject matter and legal basis of the request 
Pursuant to Article 267 TFEU, [the referring] court requests an interpretation of 
Article 5(1)(a) of Regulation 2016/679, in conjunction with Article 6(1)(a), (c) 
and (e) of that regulation, as well as Article 6(3) thereof. 
Question referred for a preliminary ruling 
Should Article 5(1)(a) of Regulation (EU) 2016/679 of the European Parliament 
and of the Council of 27 April 2016 on the protection of natural persons with 
regard to the processing of personal data and on the free movement of such data, 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-693/22 
 
2  
and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ 2016 
L 119, p. 1, as amended), in conjunction with Article 6(1)(a), (c) and (e) of that 
regulation, as well as Article 6(3) thereof, be interpreted as precluding a provision 
of national law that permits the sale, in enforcement proceedings, of a database, 
within the meaning of Article 1(2) of Directive 96/9/EC of the European 
Parliament and of the Council of 11 March 1996 on the legal protection of 
databases (OJ 1996 L 77, p. 20, as amended), which contains personal data, if the 
data subject did not consent to such a sale? 
Provisions of European Union law relied on 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC (General Data Protection Regulation) (OJ 2016 L 119, p. 1, as 
amended): Article 5(1)(a), Article 6(1)(a), (c) and (e), Article 6(3) 
Directive 96/9/EC of the European Parliament and of the Council of 11 March 
1996 on the legal protection of databases (OJ 1996 L 77, p. 20, as amended): 
Article 1(2) 
Provisions of national law relied on 
Ustawa z dnia 15 września 2000 r. Kodeks spółek handlowych (Law of 
15 September 2000 establishing the Commercial Companies Code) (Polish 
Journal of Laws of 2022, item 1467) (‘the KSH’): 
‘Article 299 
Paragraph 1. If enforcement against the company proves to be ineffective, the 
members of the management board shall be jointly and severally liable for its 
obligations. 
Paragraph 2. A member of the management board may release him- or herself 
from the liability referred to in Paragraph 1 if he or she demonstrates that, in due 
time, a petition for bankruptcy was filed, or that at the same time a decision was 
issued to commence restructuring proceedings or to approve an arrangement in 
proceedings regarding the approval of that arrangement, or that the failure to file a 
petition for bankruptcy was not his or her fault, or that, despite the failure to file a 
petition for bankruptcy and the failure to issue a decision to commence 
restructuring proceedings or the failure to approve an arrangement in proceedings 
regarding the approval of that arrangement, the creditor did not suffer any 
damage’. 
I. 
 
3 
Ustawa z dnia 17 listopada 1964 r. Kodeks postępowania cywilnego (Law of 
17 November 1964 establishing the Code of Civil Procedure) (Polish Journal of 
Laws of 2021, item 1805, as amended) (‘the KPC’): 
‘Article 2352. 
Paragraph 1. The court may, in particular, disregard evidence that: 
… 
(2) is meant to prove a fact that is indisputable, irrelevant to the resolution of the 
case, or proven in accordance with the applicant’s claim; 
Article 767. [Complaint regarding the actions of a court enforcement officer] 
Paragraph 1. Except as otherwise provided by law, complaints regarding the 
actions of a court enforcement officer may be filed with the district court. The 
same applies to omissions by a court enforcement officer. Complaints shall be 
heard by the court having jurisdiction over the court enforcement officer’s office. 
… 
Article 796. [Commencement of judicial enforcement] 
Paragraph 1. An application to commence enforcement proceedings shall be filed 
with the competent court or court enforcement officer. An application submitted 
to a court enforcement officer may be submitted on an official form. 
… 
Article 799. [Several methods of enforcement; suspension of judicial enforcement 
proceedings] 
Paragraph 1. An application to commence enforcement proceedings or a request 
that those proceedings be commenced ex officio shall allow for enforcements to be 
conducted in any manner permitted by law, except for enforcement against 
immovable property. …. 
[…] 
Article 831. 
Paragraph 1. The following shall be exempt from enforcement: 
… 
(3) non-transferable rights, unless the possibility to transfer them is 
contractually excluded and the object of performance may be enforced, or the 
exercise of a right may be entrusted to another person; 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-693/22 
 
4  
Article 9116 
Paragraph 1. If a right is attached, the creditor shall be satisfied from earnings 
generated by that right, if any, or from the proceeds obtained from the 
implementation or sale of the right’. 
Ustawa z dnia 22 marca 2018 r. o komornikach sądowych (Law of 22 March 2018 
on Court Enforcement Officers) (Polish Journal of Laws of 2022, item 1168, as 
amended) (‘the Law on Court Enforcement Officers’): 
‘Article 3. 
1. A court enforcement officer is a public authority in the sphere of the 
performance of activities in enforcement and security proceedings. Those 
activities are to be performed by the court enforcement officer, taking into account 
the exceptions provided for in the laws. 
… 
Article 9. 
1. A court enforcement officer may not refuse to accept an application to: 
(1) commence enforcement proceedings, 
… 
– in respect of whose conduct he or she is competent in accordance with the 
provisions of [the KPC]. 
Article 31. 
1. Receivables enforced from a bank account, an account held with a 
cooperative savings and credit union, or an account held with an entity conducting 
brokerage activities, obtained as a result of the first payment made by the debtor 
of the attached claim shall be transferred by the court enforcement officer to the 
creditor not earlier than 7 days and not later than 14 days from the date of receipt 
thereof. …. 
…’. 
Ustawa z dnia 27 lipca 2001 r. o ochronie baz danych (Law of 27 July 2001 on 
Database Protection) (Polish Journal of Laws of 2021, item 386) (‘the Law on 
Database Protection’): 
‘Article 1. 
Databases are subject to the protection specified in the law, irrespective of the 
protection granted under [the ustawa z dnia 4 lutego 1994 o prawie autorskim i 
I. 
 
5 
prawach pokrewnych (Law of 4 February 1994 on Copyright and Related Rights) 
(Polish Journal of Laws of 2019, item 1231, and of 2020, item 288)] to databases 
that have the characteristics of a work. 
Article 2. 
1. Within the meaning of the law: 
(1) “database” means a set of data or any other materials and elements collected 
using specific systematics or methods, individually accessible in any way, 
including via electronic means, requiring a significant investment in terms of 
quality or quantity to prepare, verify or present its content, 
… 
[Article 5.] 
(3) the producer is a legal person established in accordance with the law of a 
Member State [of the Union] or of the Member States of the European Free Trade 
Association (EFTA), being parties to the Agreement on the European Economic 
Area [(‘the EEA Agreement’)], having its registered office and principal place of 
business in the territory of the European Community [(EC)] or of the [EFTA 
Member States], being parties to [the EEA Agreement]; if the producer is based 
only in the territory of the [EC] or of the [EFTA Member States], being parties to 
[the EEA Agreement], its activity must be substantially and permanently 
connected with the economy of the Member State [of the Union] or of the [EFTA 
Member States], being parties to [the EEA Agreement]; 
Article 6. 
1. The producer of the database has the exclusive and transferable right to 
download data and re-use them in whole or in a significant part, in terms of 
quality or quantity’. 
Succinct presentation of the facts and procedure in the main proceedings 
1 It is undisputed that the applicant I. is entitled to the receivable due against the 
company NMW (which is a limited liability company with its headquarters in W.), 
and that the defendant M.W. was a member of the management board of NMW 
from the beginning of that company’s existence; however, the parties are in 
disagreement as to when the defendant was a member of the management board 
until. 
2 Since the enforcement proceedings commenced in respect of NMW’s assets ended 
with the court enforcement officer issuing a decision to discontinue the 
enforcement due to a lack of company assets, the applicant I. brought an action in 
the present case against the defendant M.W. for the payment of PLN 59 040 plus 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-693/22 
 
6  
interest, referring to paragraph 1 of Article 299 of the KSH, which provides that a 
member of the management board of a debtor company may be liable for damages 
where there is no possibility of obtaining satisfaction using the assets of that 
company. 
3 The defendant M.W. requested that the action be dismissed, arguing that NMW 
possessed and still possesses assets from which the applicant I. could satisfy its 
claim, namely, movables (office equipment), claims against third parties, 
protection rights to trade marks, source code for software for online shopping 
connected to a quasi-cashback service (Platform M.), as well as two databases of 
users of that platform. In addition, he referred to the conditions excluding his 
liability specified in paragraph 2 of Article 299 of the KSH. 
4 Most of the evidence was taken during the proceedings. However, the defendant’s 
evidentiary application, which aimed to demonstrate the fulfilment of the 
conditions under paragraph 2 of Article 299 of the KSH was excluded. The 
[referring] court found that the arguments regarding the lack of liability for the 
company’s current activities cannot lead to a dismissal of the action. 
5 At this stage, the national court had doubts as to whether the database belonging 
to NMW could be the subject of enforcement, as it contained the personal data of 
hundreds of thousands of users of Platform M. The defendant M.W. argues that 
the transferability of that property right is guaranteed by the relevant provisions of 
the Law on Database Protection. However, in the course of the proceedings, no 
arguments or items of evidence have come to light that would indicate that, by 
making their data available to the database, customers consented to the data being 
processed in the form of sharing with third parties outside Platform M. 
Succinct presentation of the reasoning in the request for a preliminary ruling 
6 The issuing of a judgment in the present case depends on determining whether the 
debtor company, of whose management board the defendant M.W. was a member, 
possessed or still possesses assets from which the applicant I. could satisfy its 
claim, as pursuant to paragraph 1 of Article 299 of the KSH, the liability of the 
defendant arises only in the event of ineffective enforcement against the assets of 
the debtor company. The only chance of satisfying the applicant’s claim is 
through the conducting of enforcement proceedings in which the assets of the 
debtor company will be sold to a third party. At the same time, the defendant must 
demonstrate that such a possibility is real, in the sense that it can be assumed with 
a high degree of probability that if the creditor (the applicant) initiated 
enforcement proceedings in respect of a given asset, the enforcement would be 
effective. A positive answer to that question will lead to the dismissal of the 
action. Before the action was brought in the present case, such enforcement was 
conducted and proved ineffective. However, this does not exclude the defendant’s 
right to enter a defence in the present proceedings or to demonstrate that the 
decision to discontinue enforcement proceedings was devoid of factual grounds. 
I. 
 
7 
The defendant M.W. highlighted several assets, with only the MAM software and 
databases having (according to the defendant’s assertions) a value that exceeds the 
amount of receivables of the applicant I. In addition, their value will also affect 
the value of the trade marks related to those products. Selling the platform itself 
without a customer database is not as attractive on the market as selling the entire 
‘package’. 
7 In the view of the national court, there is some doubt as to whether the database 
created by NMW can be traded, and thus, whether it can be sold in enforcement 
proceedings – this is a key circumstance from the perspective of the line of 
defence taken by the defendant. In addition, that court also cannot take evidence 
from an expert opinion regarding the valuation of that database, because 
paragraph 1(2) of Article 2352 of the KPC prohibits the taking of evidence without 
first determining that the evidence is relevant to the case. 
8 The question referred for a preliminary ruling aims to determine the relationship 
between the restrictions on the processing of personal data established by 
Regulation 2016/679 and the right to dispose of a database under Directive 96/9 
and national law, including the right to sell the database in the course of 
enforcement proceedings. 
9 The Law on Database Protection, which implemented Directive 96/9 into the 
national order, assumes that databases are protected (Article 1 of that law and 
Article 1(2) of Directive 96/9), and the producer (Article 1(1)(3) of the Law on 
Database Protection) has the exclusive and transferable right to download data and 
re-use them in whole or in a significant part, in terms of quality or quantity 
(Article 6 of the Law on Database Protection). The transferability of that right has 
been reserved in the directive (Article 7(3) of the directive in conjunction with 
Article 7(1) thereof). 
The right of the producer of the database is a new intellectual property right that is 
not a copyright. It is a property right, of an absolute nature, effective erga omnes, 
and can be sold. Enforcement proceedings may be conducted under any property 
right, unless there is a clear provision excluding such a possibility. The Polish 
legislature has not established any standards that would prohibit enforcements 
being conducted by means of the database related to the present proceedings. 
Although the court enforcement officer is not the producer of the database, its 
authorisation to sell the database is derived from the fact that the producer against 
whom enforcement proceedings have been commenced has the right to sell the 
database. As a rule, the court enforcement officer could not sell the database if 
that right was non-transferable within the meaning of the relevant provisions 
(paragraph 1(3) of Article 831 of the KPC). 
In the present case, it has been found that the database belonging to NMW (the 
producer) satisfied the conditions under which protection is to be granted pursuant 
to the Law on Database Protection and Directive 96/9; it contains the personal 
data of hundreds of thousands of users (Article 4(1) of Regulation 2016/679). The 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-693/22 
 
8  
only possible way of conducting enforcement by means of such a database is by 
selling it, since the database does not currently bring in any revenue (Article 9116 
of the KPC). As a side note, the [referring] court would like to highlight that, in 
the light of the arguments submitted by the parties, that database does not contain 
the information referred to in Article 9 of Regulation 2016/679. 
10 In the view of the [referring] court, the sale of the database meets the definition of 
‘processing’ within the meaning of Article 4(2) of Regulation 2016/679, as it 
directly leads to data being ‘made available’ to a third party, namely the buyer. 
The sale of the database in the course of enforcement proceedings does not fall 
within the scope of the exclusions specified in Article 2(2) of Regulation 
2016/679. In the view of the [referring] court, the court enforcement officer 
becomes the controller of such a database for the duration of the enforcement 
proceedings (Article 4(7) of Regulation 2016/679), as it is the person who 
conducts the sale procedure, is obliged to secure the asset, and therefore is also 
responsible for ensuring that the data are processed in accordance with the law 
(Article 5(1)(a) and Article 5(2) of Regulation 2016/679). 
11 Data processing is lawful only in cases where – and to the extent that – at least 
one of the conditions laid down in Article 6 of Regulation 2016/679 is satisfied. 
No evidence has been collected in the case that would permit a finding that the 
data subjects to whom the personal data collected in the database relate consented 
to their data being transferred to third parties, outside of the activity related to 
Platform M., or to the sale of those data in the course of enforcement proceedings, 
which, from the point of view of national procedural provisions, leads to the 
conclusion that such consent does not exist. Consent to the processing of data for 
the purpose of using the functionalities of that platform does not mean consent to 
processing for any possible purpose, or to sharing data with any entity. Consent 
(Article 4(11) of Regulation 2016/679) to processing must specify the scope of 
that processing, that is to say, the specific purpose (Article 6(1)(a) of Regulation 
2016/679). 
Regulation 2016/679 does not establish an absolute principle of data protection 
against disclosure to third parties without their consent. In the present case, the 
possibility of referring to the premiss of Article 6(1)(f) of Regulation 2016/679 
must be excluded, as it cannot be relied on by public authorities in the 
performance of their tasks, and a court enforcement officer is such an authority. 
The situation in question also fails to satisfy the conditions of Article 6(1)(b) and 
(d) of Regulation 2016/679. 
Therefore, the only possibility of conducting enforcement by means of such a 
database may be based on Article 6(1)(c) and (e) of Regulation 2016/679. 
12 Article 6(1)(c) of Regulation 2016/679 stipulates that the processing of personal 
data is permissible when it is necessary for compliance with a legal obligation to 
which the controller is subject. Therefore, there must be a legal provision that 
I. 
 
9 
imposes on the given entity an order to take action or refrain from taking action in 
a specific direction (purpose). Article 6(3)(a) and (b) of Regulation 2016/679 
further clarifies that the basis for the processing referred to in Article 6(1)(c) of 
that regulation is to be laid down by EU law or by the Member State law to which 
the controller is subject. 
In the view of the [referring] court, such a basis for the processing of personal data 
contained in the database has been reserved in the provisions of national law, 
namely paragraph 1 of Article 796 of the KCP and the first sentence of 
paragraph 1 of Article 799 thereof, as well as Article 3(1) and Article 9(1)(1) of 
the Law on Court Enforcement Officers, from which it is apparent that a court 
enforcement officer, as a public official, cannot refuse to execute an application to 
commence enforcement proceedings, and the application orders enforcement in 
respect of all assets belonging to the debtor, which includes the database. 
The purpose of the processing of personal data is also important, and this, in the 
view of the [referring] court, is apparent from Article 9116 of the KPC, which 
authorises the court enforcement officer to sell the database and, as a 
consequence, transfer the sum of money obtained from such enforcement to the 
creditor (first sentence of Article 31(1) of the Law on Court Enforcement 
Officers). The sale is part of the execution of the application to commence 
enforcement proceedings. Without disclosing the personal data contained in the 
database, it is not possible to sell it, because the sale always involves the release 
of the given asset to the buyer. To guarantee the effectiveness of that rule, a 
special appeal has also been introduced, which can be brought in the event of a 
court enforcement officer’s failure to perform that obligation (paragraph 1 of 
Article 767 of the KPC). 
However, Article 6(3) in fine of Regulation 2016/679 states that ‘the Member 
State law shall meet an objective of public interest and be proportionate to the 
legitimate aim pursued’. 
The doubts of the [referring] court are due to the fact that the enforcement 
proceedings by their very nature are conducted to satisfy the claims of a specific 
entity and not in the public interest. Despite the fact that the provisions do not 
exclude the possibility of several entities conducting joint enforcement, its essence 
is aimed at protecting the interest of the individual, not the collective interest. On 
the other hand, providing the creditor with the possibility of real enforcement of a 
court judgment issued on behalf of the Republic of Poland serves to strengthen 
citizens’ trust in the State, and is in the general interest of the judiciary, which can 
be perceived as a kind of public interest. 
In the view of the [referring] court, even assuming that the ‘public interest’ 
condition has been satisfied, the proportionality of the adopted measure to the set 
goal is questionable. In this regard, the [referring] court would like to highlight the 
risk associated with such an enforcement sale. There are no provisions of national 
law that introduce subjective restrictions as to the purchaser of the database – the 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-693/22 
 
10  
only condition is having full legal capacity. This means that the buyer may also be 
an entity from outside the European Union that does not guarantee compliance 
with the conditions for handling personal data, as provided in Regulation 
2016/679, or the State Treasury, which could involve public authorities obtaining 
a range of information about their citizens that goes beyond what is necessary for 
the performance of tasks by public authorities. There is also a question as to which 
is more important – the interest of the creditor for whom enforcement by means of 
the database is the only means of obtaining the funds due to it, or the interest of 
tens or perhaps hundreds of thousands of natural persons whose personal data will 
be transferred to the entity that offers the highest price. It is unclear according to 
which criteria this evaluation should be carried out. 
13 Similar doubts may arise based on Article 6(1)(e) of Regulation 2016/679, which 
permits data to be processed if this is necessary for the performance of a task 
carried out in the public interest or in the exercise of official authority vested in 
the controller. 
The [referring] court has doubts as to whether conducting enforcement can be 
classified as ‘a task carried out in the public interest’. There is also doubt as to 
whether a court enforcement officer is exercising official authority when 
conducting the enforcement, although it must be stipulated that in Article 3 of the 
Law on Court Enforcement Officers, a court enforcement officer is granted the 
status of a public authority. Irrespective of this, the abovementioned restrictions 
contained in Article 6(3) in fine of Regulation 2016/679 also apply in this regard. 
14 The last doubt concerns the relationship between Regulation 2016/679 and 
Directive 96/9 as well as the provisions of the Law on Database Protection 
implemented on the basis of that directive, that is to say, whether the personal data 
contained in the database referred to in the directive are subject to protection on 
the basis of the rules set out in Article 6 of Regulation 2016/679. The essence of 
the sui generis right to a database introduced into the EU legal order is the 
possibility of downloading data and re-using those data. A negative answer to that 
question may, in fact, lead to the producer of the database being deprived of the 
ability to make the data available to third parties (re-use).