Source: http://rychlicki.net/en/issue/polish-institutions/inspector-general-for-personal-data-protection/
Timestamp: 2019-04-20 12:57:02+00:00

Document:
The Inspector General for Personal Data Protection (GIODO) in its decision of 13 September 2010 case file DOLiS/DEC-1013/10 concerning DOLiS-440-276/10 ruled that according to the wording of Article 18(1) pt 2 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, in the event of the breach of provisions on personal data protection, the GIODO ex officio or at the request of the person concerned, by an administrative decision, shall order the restoration of the situation in accordance with the law and, in particular, to complete, update correct, disclose or not to disclose of personal data.
6) to erase the personal data.
Given the circumstances of the case, the GIODO considered that he is authorized – by the established rules – to order the Company to disclose to the applicant information about a person who, on in 2010, at 20:29 had registered on www.gowork.pl web portal using the nickname “anonymous”, i.e. information about IP address of a computer used to post the questioned entry.
Categories: Art. 18 PPD | e-documents | e-evidences | e-law issues | Inspector General for Personal Data Protection | ISP liability | legal regulations on computer networks | personal data | Polish Act on Protection of Personal Data.
Who is the controller in social networking sites?
The question of who is the “controller” and the differences between a “controller” and “processor” as defined in the article 2(d) and (e) of the Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, in the context of social networking sites (SNS), are at least controversial not only in Polish case law. See for instance T. Zeggane, W. Maxwell, US and EU Authorities Review Privacy Threats On Social Networking Sites, Ent. L.R. 2008, 19(4), 69-74.
As you can read from the above, the authors suggest that the situation requires a clarification of the concept of “controller” in terms of SNS. A similar view was also presented in the report of the European Network and Information Security Agency (ENISA), “Security Issues and Recommendations for Online Social Networks“, PDF file, p. 25.
Categories: Art. 7 PPD | Directive 95/46/EC | EU law | Inspector General for Personal Data Protection | Polish Act on Protection of Personal Data | Polish courts | Polish law | Polish Supreme Administrative Court | Voivodeship Administrative Court.
According to lawyers representing the singer Maryla Rodowicz, on the forum of one of the Polish portal websites appeared entries with the content which allegedly violated her personal rights (interests). The lawyers requested the owner to reveal IP addresses of users who posted these entries. The administrator of the portal website deleted the disputed entries but did not reveal any of the IP addresses. Lawyers filed a request to the Inspector General for Personal Data Protection (GIODO), who ordered the portal to disclose IPs on the grounds that these numbers are personal data. The owner of the portal again refused. The case went to the Voivodeship Administrative Court (VAC) in Warsaw, which in a judgment of 3 February 2010, case file II SA/Wa 1598/09 upheld the decision of the GIODO. The company who owns the portal may file a cassation to the Supreme Administrative Court (SAC). The VAC judgment provides the interpretation that IP address is a personal data, in accordance with the statutory definition included in article 6 of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with later amendments.
The VAC also noted that the IP address is personal data if it is permanently assigned to the specified device, and that device is used or operated by a specified entity. This dependence makes certain, in given situations, that there is the possibility of identifying such entity. The Court said that it is true that the IP address itself is not sufficient to identify a person who use it, but together with other information a person can be identified. Grupa o2, the owner of a portal website filed a cassation complaint.
The Supreme Administrative Court in its judgment of 19 May 2011 case file I OSK 1079/10 dismissed the complaint and decided that information on the date and contents of the posts that are correlated with IP addresses, allows for unambiguous determination of identity of persons who have violated someone’s personal interests.
There was another court’s decision with regard to the aforementioned case and the disclosure of IP addresses. See “Telecommunications law, case I OSK 1079/10“. The U.S. courts and judges have quite different views on this issue. Read for example Johnson v. Microsoft Corp., 2009 WL 1794400 (W.D. Wash. June 23, 2009).
Categories: Art. 6 PPD | computer law | defamation | e-law issues | Inspector General for Personal Data Protection | ISP liability | legal regulations on computer networks | personal data | personal rights or interests | Polish Act on Protection of Personal Data | Polish courts | Polish law | Voivodeship Administrative Court.
The main sources of binding laws in the Republic of Poland are the Constitution of 2 April 1997, acts passed by the Parliament, ratified international treaties and regulations issued, for example, by the Prime Minister or the Council of Ministers – Polish government. Regulations are issued for the purpose of implementation of acts. The main legal acts on personal data protection in the Republic of Poland are the following.
The Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), Journal of Laws (Dziennik Ustaw) of October 29, 1997, No. 133, item 883, unified text published in Journal of Laws (Dziennik Ustaw) of July 6, 2002, No. 101, item 926, with subsequent amendments.
The Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments.
Administrative Proceedings Code – APC – (in Polish: Kodeks postępowania administracyjnego) of 14 June 1960, Journal of Laws (Dziennik Ustaw) No. 30, item 168, consolidated text of 9 October 2000, Journal of Laws (Dziennik Ustaw) No. 98, item 1071 with subsequent amendments.
Act on proceedings before administrative courts – PBAC – (in Polish:Prawo o postępowaniu przed sądami administracyjnymi) of 30 August 2002, Journal of Laws (Dziennik Ustaw) No. 153, item 1270, with subsequent amendments.
Civil Proceedings Code – CPC (in Polish: Kodeks Postępowania Cywilnego) of 17 November 1964, Journal of Laws (Dziennik Ustaw) No. 43, item 296, with subsequent amendments.
See “Polish case law on personal data protection“.
Since 1 May 2004, which was the accession day to the EU, the Republic of Poland has been bound by all aquis communitaire, including judgments of the Court of Justice of the European Union.
The Republic of Poland is a party of many International treaties and agreements concerning the protection of personal data.
The Inspector General for Personal Data Protection decides cases within its competence under provisions of the Code of Administrative Proceedings, unless provided for otherwise. A party dissatisfied with a decision issued by the GIODO may request for the reconsidering of the case. The decision by the GIODO on the application to reconsider the case may be appealed against with the Voivodeship Administrative Court. The judgment of the VAC may be a subject to a cassation complaint which is decided by the Supreme Administrative Court.
Categories: Inspector General for Personal Data Protection | personal data | Polish Act on Protection of Personal Data | Polish Civil Code | Polish Constitution | Polish courts | Polish law | Polish Supreme Administrative Court | regulations | review | Voivodeship Administrative Court.
Below you will find a list of judgments and decisions on personal data protection in the context of IT technologies. You can find a more detailed discussion on each judgment or decision under the link provided with the case file. All judgments and decisions are given in chronological order.
– The judgment of the Supreme Administrative Court of 21 August 2013 case file I OSK 1666/12.
– The judgment of the Voivodeship Administrative Court of 7 October 2011 case file II SA/Wa 364/11.
– The judgment of the Supreme Administrative Court of 19 May 2011 case file I OSK 1086/10.
– The judgment of the Supreme Administrative Court of 19 May 2011 case file I OSK 1079/10.
– The judgment of the Voivodeship Administrative Court in Warsaw of 16 March 2011 case file II SA/Wa 2037/10.
– The judgment of the Voivodeship Administrative Court in Warsaw, of 1 December 2010, case file II SA/Wa 1212/10. This judgment is not yet final.
– The decision of the Inspector General for Personal Data Protection of 13 September 2010 case file DOLiS/DEC-1013/10.
– The order of the Supreme Administrative Court of 15 July 2010 case file I OSK 1079/10. This decison is related to the judgment of the Voivodeship Administrative Court in Warsaw, of 3 February 2010, case file II SA/Wa 1598/09.
– The judgment of the Supreme Administrative Court of 11 May 2010, case file I OSK 963/09.
– The judgment of the Supreme Administrative Court of 15 March 2010 case file I OSK 756/09.
– The judgment of the Voivodeship Administrative Court in Warsaw, of 3 February 2010, case file II SA/Wa 1598/09. This judgment is not yet final. The cassation complaint may be filed to the Supreme Administrative Court.
– The judgment of the Supreme Administrative Court in Warsaw, of 18 November 2009, case file I OSK 667/09.
– The judgment of the Voivodeship Administrative Court in Warsaw of 26 August 2009 case file II SA/Wa 297/09.
– The judgment of the Supreme Administrative Court of 3 July 2009 case file I OSK 633/08.
– The judgment of the Voivodeship Administrative Court in Warsaw of 3 March 2009, case file II SA/Wa 1495/08.
– The judgment of the Supreme Administrative Court of 26 January 2009 case file I OSK 174/08.
– The judgment of the Voivodeship Administrative Court in Warsaw of 30 Novmeber 2007, case file II SA/Wa 71/07.
– The judgment of the Voivodeship Administrative Court in Warsaw of 9 February 2005, case file II SA/Wa 1085/04.
See also “Polish regulations on personal data protection“.
Categories: case law | Inspector General for Personal Data Protection | Polish Act on Protection of Personal Data | Polish courts | Polish Supreme Administrative Court | Voivodeship Administrative Court.
An individual had a telecommunications services agreement with a Company, but failed to comply with the payment and the Company has assigned the claim to another entity. The debtor requested by the assignee filed a complaint to the Inspector General for Personal Data Protection. It found that the operation of the company not been in conflict with the provisions of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments. The debtor filed a complaint against this decision.
The Voivodeship Administrative Court in Warsaw in its judgment of 26 August 2009 case file II SA/Wa 297/09 held that the transfer of the debt is inseparably connected with the transfer of personal data of the debtor. Such situation is in accordance with the provisions of Article 509 § 2 of the Civil Code – CC – (in Polish: Kodeks Cywilny) of 23 April 1964, published in Journal of Laws (Dziennik Ustaw) No. 16, item 93, with subsequent amendments.
Article 509. § 1. The creditor may, without the debtor’s consent, transfer the receivable debt upon a third party (assignment) unless that would be at variance with statutory law, a contractual stipulation, or the nature of the obligation.
§ 2. Together with the receivable debt, the rights connected therewith shall pass to the acquirer, in particular, the claim for the interest in arrear.
All related rights together with the debt claim are transferred to the acquirer, and thus the right to dispose of the debtor’s personal information in order to implement the debt. The acquirer becomes autonomous possessor of the debtor’s personal data. The acquirer becomes the controller of personal data and processes personal information for its own account and risk. The acquirer enjoys the same rights and obligations relating to the processing of personal data as the previous controller.
Categories: Art. 23 PPD | Art. 31 PPD | Art. 509 CC | Inspector General for Personal Data Protection | personal data | Polish Act on Protection of Personal Data | Polish Civil Code | Voivodeship Administrative Court.
The Voivodeship Administrative Court in Warsaw in its judgment of 3 March 2009, case file II SA/Wa 1495/08 decided on the protection of personal data and providing and operating online services such as websites about users’ classmates. The VAC ruled that in accordance with article 6(2) of the Polish Act of 29 August 1997 on the Protection of Personal Data – PPD – (in Polish: Ustawa o ochronie danych osobowych), unified text published in Journal of Laws (Dziennik Ustaw) of 6 July 2002, No. 101, item 926, with subsequent amendments, not only information on the current situation of an individual decide whether one is dealing with personal data, but also information relating to what a person did and who one was in the past. It means that such data are protected under the Act on Protection of Personal Data.
Categories: Art. 6 PPD | EU law | Inspector General for Personal Data Protection | legal regulations on computer networks | personal data | personal rights or interests | Polish Act on Protection of Personal Data | Polish courts | Polish law | telecommunication law | Voivodeship Administrative Court.

References: Art. 18
 Art. 7
 v. 
 Art. 6
 § 2
 § 1

§ 2
 Art. 23
 Art. 31
 Art. 509
 Art. 6