NSA - III OSK 161/21

NSA - III OSK 161/21
Court:	NSA (Poland)
Jurisdiction:	Poland
Relevant Law:	Article 5(1)(c) GDPR Article 5(2) GDPR Art. 23(1)(1) Personal Data Protection Act (1997) Art. 23(1)(5) Personal Data Protection Act (1997) Art. 172(1) Telecommunications Law
Decided:	20.04.2021
Published:
Parties:
National Case Number/Name:	III OSK 161/21
European Case Law Identifier:
Appeal from:	WSA Warsaw (Poland) II SA/Wa 943/17
Appeal to:
Original Language(s):	Polish
Original Source:	Centralna Baza Orzeczeń Sądów Administracyjnych (in Polish)
Initial Contributor:	Agnieszka Rapcewicz

The Supreme Administrative Court of Poland held that consent to the processing of personal data for marketing purposes is a prerequisite for the lawfulness of processing by a controller. The consent is independent of the means of direct marketing and should be treated separately.

English Summary

Facts

The Company V. obtained from potential customers (i.e. persons applying for a loan) and customers the following consent:

"I consent to the processing of my personal data by V. Sp. z o.o. for the purpose of direct marketing relating to the products and services of entities belonging to the "[...]" capital group, carried out by using telecommunications terminal equipment and automatic calling systems in accordance with Article 172 of the Telecommunications Law (Journal of Laws of 2014, item 234, as amended), and for this purpose I make available the data provided by me in this application with regard to: e-mail address and telephone number.".

In relation to persons who gave the above consent, the Company conducted marketing activities by making telephone calls, sending text messages and emails.

The General Inspector for Personal Data Protection issued a decision against the Company, which was appealed to the Provincial Administrative Court in Warsaw. In its judgment of 26 February 2018, ref. II SA/Wa 943/17, it dismissed the complaint of the company V. The Company appealed from the above judgment.

Dispute

The dispute concerned whether, on the grounds of the Act of 29 August 1997 on personal data protection, it is permissible to express a single consent to processing personal data for the purpose of direct marketing of the Company's products and using telecommunications terminal equipment for the purpose of such marketing, referred to in Article 172 of the Act of 16 July 2004 Telecommunications Law.

Holding

The Supreme Administrative Court has dismissed the cassation appeal. The court held that the expression of consent to the processing of data for marketing purposes is a prerequisite for the lawfulness of processing of personal data by the data controller, and the consent is independent of the means by which the marketing is directed and should be separated from the means of direct marketing. The person giving consent must understand the essence of the consent, its purpose and effects, and thus must have a full understanding by whom and for what specific purpose his/her data will be processed. Moreover, the processing of personal data for the purpose of marketing to other entities should only take place with the consent of the data subject. This consent should therefore be separated.

Comment

The Supreme Administrative Court has confirmed the correctness of the position of the court of first instance that the consent may cover various purposes of personal data processing. When processing personal data, the person whose personal data will be used should be afforded maximum legal protection, in particular where the data will be used for marketing purposes. The person should be given the possibility to give his or her consent not only in a yes/no way, but in an 'extended consent' relating to specific fields of use of the data concerned. Such a choice is not ensured by the practice applied by the Company disclosed in the proceedings before the Inspector General for the Protection of Personal Data because the person granting the consent may not grant it only partially. For this reason, it is reasonable to provide the customer with an optionality of giving consent to the processing of personal data by the Company cooperating with other entities. The inclusion of several consents in the content of one statement results in the lack of possibility to choose the consent to be given. This means that the data subject does not have full freedom to dispose of his/her personal data. According to Article 23 (1)(1) of the Act on the Protection of Personal Data, giving the consent to process the data for marketing purposes constitutes the prerequisite of the legality of processing of personal data by the controller, and the consent is independent of the means by which the marketing is directed and should be separated from the means of direct marketing. In the present case, from the requirements indicated in Article 172, paragraph 1 of the Telecommunications Law. An entity asking a natural person to give such consent must do so in a clear, unambiguous manner, distinguishing it from other information and statements coming from that entity. The person giving his/her consent must understand the essence of the consent, its purpose and effects, and therefore must have a full understanding of precisely by whom and for what specific purpose his/her data will be processed.

NSA emphasised that the client should know which entities the consent relates to and be able to choose in this respect. In the present case, the construction of the disputed clause, which introduces an unnecessary requirement of consent for marketing of the Company's products and services, may, for example, create doubts on the part of clients as to the desired marketing of the Company's products and services - in a situation where they do not consent to marketing of products and services of other entities belonging to the "[...]" group. Nor can it be assumed, as the applicant claims, that the customers are aware of the objects of the entities belonging to the '[...]' group and, consequently, that they know what information they will receive regarding the products and services of those entities.

The Court emphasised that the consent used by the Company does not give the possibility to choose between marketing the products and services of the Company as a data controller and the products and services of other unspecified entities. Contrary to the applicant's position, it is also important that one consent concerns two independent legal grounds contained in different acts. As a result, it should be concluded that the consent pertains to various purposes of personal data processing, i.e. marketing of products and services of the Company, marketing of products and services of other entities and the possibility of using telecommunication terminal equipment and automatic calling systems for marketing. It should be added here that although the Company is exempted from obtaining consent for marketing of its own products and services, it is clear from the quoted clause that the consent is also to cover marketing of the Company's products and services. In addition, it should be noted that in order for the Company to conduct direct marketing of its products and services using telecommunications terminal equipment and automatic calling systems to process personal data, it must obtain the consent of customers and potential customers pursuant to Article 172(1) of the Telecommunications Law. Therefore, it should be assumed that if, as in the present case, the consent is to relate to various issues related to the processing of personal data, the consent should be given separately for each of them.

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.

SENTENCE
The Supreme Administrative Court, composed of Chairman: Judge NSA Teresa Zyglewska Judges Judge NSA Zbigniew Ślusarczyk (spr.) Judge NSA Olga Żurawska - Matusiak having examined on 20 April 2021 at a closed session in the General Administrative Chamber a cassation appeal by V. Sp. z o.o. z/s in W. against the judgment of the Provincial Administrative Court in Warsaw of 26 February 2018, ref. no. II SA/Wa 943/17 in the case involving a complaint by V. Sp. z o.o. z/s in W. against the decision of the General Inspector for Personal Data Protection of [...] April 2017 No. [...] on the processing of personal data dismisses the cassation appeal.

JUSTIFICATION
The Provincial Administrative Court in Warsaw, in its judgment of 26 February 2018, ref. no. II SA/Wa 943/17, pursuant to Article 151 of the Act of 30 August 2002. - Law on proceedings before administrative courts (Journal of Laws of 2019, item 2325 as amended) hereinafter referred to as "p.p.s.a." dismissed the complaint of V. Sp. z o.o. z/s in W. against the decision of the General Inspector for Personal Data Protection of [...] April No. [...] on personal data processing.

In the opinion of the Court of First Instance, the essence of the dispute concerned whether, on the grounds of the Act of 29 August 1997 on personal data protection (Journal of Laws of 2016, item 922), it is permissible to give one consent to the processing of personal data for the purpose of direct marketing of products of V. Sp. z o.o. and the use of telecommunications terminal equipment for the purpose of such marketing, as referred to in Article 172 of the Act of 16 July 2004. Telecommunications Law (Journal of Laws of 2016, item 1489, as amended). As indicated by the Court of First Instance, when processing personal data, maximum legal protection should be provided to the person whose personal data are used. This means that the person should not only be able to refuse the use of his/her personal data in its entirety, but should be entitled to choose in what sphere he/she consents to the use of the marked data. However, the solution adopted by the appellant, consisting in including several consents in one declaration, leads to a situation in which the person does not have full freedom in disposing of his personal data. Furthermore, in the opinion of the Court of First Instance, expressing a single consent with regard to two independent legal grounds and purposes of data processing may mislead the person who gives consent to the processing of his/her personal data. Therefore, if the consent is to relate to different purposes of personal data processing, it should be given separately for each purpose.

The cassation appeal was lodged by V. Sp. z o.o. z/s in W., appealing against the above judgment in its entirety. It was alleged that the substantive law provisions had been violated by misinterpretation and misapplication, i.e:

1. Article 23(1)(1) of the Act "of 29 August 1007" on the protection of personal data (Journal of Laws of 2016, item 922) (hereinafter in the wording of the complaint as the Act) "by incorrectly assuming that the content of consent to data processing for marketing purposes does not allow for a conscious and free expression of a declaration of will, disregarding the fact that the consent in question applies to only a part of the clause, i.e. consent to processing for marketing purposes of the company's products, and with regard to this scope it was granted effectively",

2. Article 23(1)(5) of the Act by incorrectly assuming that that provision does not apply to the part of the clause submitted to the applicant's clients: "(...) for the purpose of direct marketing concerning the products and services of entities belonging to the [...] capital group, (...)", in particular that the wording of Article 23(1)(5) excludes the application of the so-called "legalising consent",

3. Article 23(1)(3) and Article 26(1)(3) of the Act in assuming that the processing of personal data carried out by the appellant in the facts of the case was inappropriate for the purpose for which the data were intended, which is in clear contradiction with the scope of data processing carried out by the appellant and the legal basis for its actions, including in particular the necessary and parallel references to specific provisions

4. Article 172.1 of the Telecommunications Law (Journal of Laws of 2014, item 243, as amended) by erroneously assuming that the consent referred to in that provision is not applicable in the present case due to the different scope of regulation of the Act and the Telecommunications Law, i.e. the allegedly divergent nature of the declaration of will, i.e. by holding that that provision is unrelated to the manner in which personal data are processed, whereas the sending of marketing materials to the e-mail address or telephone number of an identified person is inextricably linked to the processing of that person's personal data and therefore it is not possible to carry out direct marketing using telecommunications terminal equipment without processing that person's personal data

therefore it is not possible to carry out direct marketing by means of telecommunication terminal equipment without also processing the personal data of the identified person, which means that it must be assumed that, where a person is aware that such equipment will be used in respect of that person, there is no need to obtain another consent for the same action, involving the same action in the form of sending a marketing message to an email address or telephone number.

Based on the pleas formulated in this way, it was requested that the judgment under appeal be reversed in its entirety and the case be referred back to the Voivodship Administrative Court in Warsaw for re-examination. Moreover, it was requested that the costs of the proceedings, including the costs of legal counsel's representation, be awarded in favour of the appellant.

In the justification of the cassation appeal it was indicated that the applicant does not need to obtain consent for the processing of personal data for the purposes of direct marketing of its own products and services, as such processing is carried out on the basis of Article 23 (1) para. 5 and Article 24(4) of the Act. Only to the extent to which the complainant performs marketing of products and services of other entities, it is obliged to obtain consent from data subjects. The author of the cassation appeal does not agree with the statement that the declaration of will made by customers or potential customers of the complainant relates to substantially different purposes of processing, so that the consent should be expressly given under each of these purposes of processing. In that regard, the person giving consent to the processing of his personal data is fully aware that, once he has given his consent, he will receive information on the loans offered by the applicant's partners. On the other hand, the separation of the consents for own marketing and marketing of other entities will result in misleading the person giving consent to the processing of personal data. The author of the cassation appeal argues that it is not the entities to which the consent relates, but the purpose of data processing that determines the scope of the consent. Moreover, the contested decision does not take into account the content of Article 172(1) of the Telecommunications Act. The sending of marketing messages takes place exclusively using telecommunications terminal equipment and automatic calling systems, and the consent that may be expressed by the applicant's customers or potential customers therefore concerned the purpose of performing marketing activities by the applicant in the manner specified therein.

In response to the cassation appeal, the President of the Office for Personal Data Protection filed for dismissal of the cassation appeal. In the opinion of the authority, the appealed judgment is in line with the law.

The Supreme Administrative Court held as follows:

By order of 29 January 2021. The Chairperson of Division III in the Ogónoadministrative Chamber of the Supreme Administrative Court, invoking Article 15 zzs⁴(3) of the Act of 2 March 2020 on special solutions related to the prevention, counteraction and combating of COVID-19, other infectious diseases and crisis situations caused by them (Journal of Laws 2020, item 1842, as amended, hereinafter referred to as uCOVID-19), referred the case to a closed hearing, on the grounds that the holding of the hearing required by the Act could cause undue health risks to those participating in it and cannot be conducted remotely with simultaneous video and audio transmission. Accordingly, the parties to the proceedings were notified of the referral of the case to a closed hearing for the examination of the cassation appeal. Furthermore, the parties were instructed that they have the right, within 7 days from the date of receipt of the notification, to present their additional written opinion on the case within the limits of the grounds of the cassation appeal filed.

Therefore, it was necessary to decide in the case whether it is permissible, in the light of Article 15 zzs⁴ uCOVID-19, to hear the case at a closed session. In the opinion of the Supreme Administrative Court, taking into account the principle of openness of court hearings (Article 10 of p.p.s.a.) and the rule that court-administrative cases are heard in the form of a hearing (Article 90 § 1 of p.p.s.a.), while reserving an exception to them where a "special provision" so provides, with appropriate application of the solutions provided for in Article 15zzs4(2) and (3) of uCOVID-19, this question should be answered in the affirmative. It follows from these provisions respectively that: "During the period when the state of epidemic emergency or the state of epidemic declared due to COVID-19 is in force and within one year from the cancellation of the last of them, the provincial administrative courts and the Supreme Administrative Court shall hold a hearing with the use of technical devices making it possible to hold it remotely with simultaneous direct transmission of images and sound, with the reservation that the persons participating in it do not have to be in the court building, unless holding the hearing without the use of the above devices will not cause an excessive risk to the health of the persons participating in it" (paragraph 2) and "The chairman may order a closed session if he considers it necessary to hear the case and the hearing required by the Act would cause an undue risk to the health of persons participating in it and cannot be conducted remotely with simultaneous direct transmission of images and sound. In closed session in these cases the court shall decide in a panel of three judges" (paragraph 3). It should be borne in mind that the original version of uCOVID-19 included the provision of Article 15 zzs(6), the content of which implied that during the period of an epidemic emergency or state of epidemic declared due to COVID-19 "no hearings or public hearings shall be held", with the exception of hearings and public hearings in the cases specified in Article 14a(4) and (5) of that Act, defined as "urgent". The legislator did not include the present case in the catalogue of such urgent cases. The repeal of the provisions of Articles 14a and 15zzs of uCOVID-19 took place at the same time as the addition to that Act of, inter alia, the previously cited regulations contained in its Article 15 zzs4(2) and (3). The sense of such action of the legislator comes down, therefore, to the fact that the existing state of epidemics declared due to COVID-19 (which is a notorious circumstance) does not currently constitute an obstacle, inter alia, to the Supreme Administrative Court acting in the present case in closed session. The addition of the provisions of Article 15 zzs4(2) and (3) in uCOVID-19 warrants consideration as to whether the solutions provided for therein - in view of the undoubtedly continuing state of the COVID-19 epidemic - should apply to the present case. In the opinion of the Supreme Administrative Court, the functional interpretation of the provisions of uCOVID-19 dictates that the construction contained in Article 15zzs4(3) of uCOVID-19 may be applied in the present case and that the cassation appeal may be examined in closed session. The right to a public hearing is not absolute and may be subject to limitation, also in view of the content of Article 31 Section 3 of the Constitution of the Republic of Poland, which refers to limitations on the exercise of constitutional freedoms and rights when it is provided for in a statute and only when it is necessary in a democratic state, inter alia, for the protection of health. There is no doubt that the purpose of the application of the constructions envisaged by the provisions of uCOVID-19 is, inter alia, the protection of human life and health in connection with the prevention and eradication of COVID-19 infection, and in the present state of facts there are such circumstances which, in the ordered state of the pandemic, fully dictate that the solutions of the above Act be taken into account in the practice of the organs of justice. From the perspective of preserving the right to a fair trial, the most important thing is to preserve the right of the party to present its position in the case (guarantee of the right of defence). A derogation from an open hearing of an administrative court in favour of a closed hearing, as allowed by specific provisions, should be made in keeping with the requirements of a fair trial. This standard of protection of the rights of the parties and participants was preserved, since by the aforementioned order of the Chair of the Division dated 29 January 2021, the parties were notified about it and had the opportunity to take a position on the case.
Summarizing the above remarks, the panel of the Court hearing the present case held that it was permissible to hear the cassation appeal filed therein in closed session pursuant to Article 15zzs4(3) of uCOVID-19, since the holding of the hearing required by the Act could cause an undue risk to the health of the persons participating therein and the hearing cannot be held remotely with simultaneous direct transmission of video and sound.

Turning to the examination of the cassation appeal, it should be indicated that, pursuant to Article 183 § 1 of the Act of 30 August 2002. - Law on proceedings before administrative courts (i.e. Journal of Laws of 2019, item 2325, as amended), hereinafter referred to as p.p.s.a., the Supreme Administrative Court examines the case within the limits of the cassation complaint, considering ex officio only the invalidity of the proceedings. In the case under review, none of the circumstances resulting in invalidity of the proceedings, referred to in Article 183 § 2 of p.p.s.a., and none of the prerequisites referred to in Article 189 of p.p.s.a., which the Supreme Administrative Court considers ex officio when reviewing the judgment appealed against in cassation, occur. Under these circumstances, only the charges raised in the cassation appeal in support of the cassation grounds quoted were subject to examination in the case.

The cassation appeal raised only allegations of violation of substantive law. Therefore, the Supreme Administrative Court assessed these allegations on the basis of the facts established by the Inspector General for Personal Data Protection and approved by the Court of First Instance. This statement is important insofar as the author of the cassation complaint justifies a part of the raised charges with arguments based on a factual state other than the one accepted by the authority and the Court. Meanwhile, the assessment of the legitimacy of the allegation of violation of the substantive law may be performed exclusively on the basis of the factual state established in the case and not on the basis of the factual state which the appellant deems correct (cf. judgment of the Supreme Administrative Court of 13 August 2013, ref. no. II GSK 717/12, LEX no. 1408530; judgment of the Supreme Administrative Court of 4 July 2013, ref. no. I GSK 934/12, LEX no. 1372091). Moreover, it should be noted that in the NSA jurisprudence there is an unquestionable opinion that an attempt to combat factual findings made by the court of first instance may not be made by means of a plea alleging a violation of substantive law (Article 174 paragraph 1). Alternatively, it may be effective only within the framework of the cassation grounds listed in Article 174 paragraph 2 (see judgment of the Supreme Administrative Court of 6 July 2004, ref. no. FSK 192/04, ONSAiWSA 2004, no. 3, item 68). Moreover, the allegation of infringement of substantive law may not be effectively substantiated by an attempt to dismiss the findings made in the case (see judgment of the Supreme Administrative Court of 16 September 2004, file ref. no. FSK 471/04, ONSAiWSA 2005, no. 5, item 96), as it is the case in the cassation appeal filed in this case. Therefore, the Company's arguments based on findings different from those approved by the Court of First Instance could not constitute grounds for the raised charges.
The authority's findings indicate that the Company obtains from potential customers (i.e. persons applying for a loan) and customers the following consent: "I consent to the processing of my personal data by V. Sp. z o.o. for the purpose of direct marketing concerning the products and services of entities belonging to the "[...]" capital group, performed with the use of telecommunications terminal equipment and automatic calling systems in accordance with Article 172 of the Telecommunications Law (Journal of Laws of 2014, item 234, as amended) and for this purpose I make available the data provided by me in this application in the following scope: e-mail address and telephone number.". The Company belongs to the "[...]" capital group. In relation to persons who have given the above consent, the Company conducts marketing activities by making telephone calls, sending text messages (sms) and e-mails. The authority found that the clause in question contained three different declarations of intent, i.e. 1) consent to the processing of personal data of potential clients and customers of the Company for the marketing of products and services of the Company, 2) consent to the processing of personal data of potential clients and customers of the Company for the marketing of products and services of entities belonging to the "[...]" capital group, and 3) consent to the use of telecommunications terminal equipment and automatic calling systems for the purposes of direct marketing. It should be emphasised here that the marketing offers are to concern products and services of entities belonging to the "[...]" capital group, to which the Company also belongs. Therefore, the consent applies both to the products and services of the Company and other entities.

The parties agree that the substance of the dispute as regards the injunction imposed on the Company in point I. 1. of the decision of [...] February 2017 boils down to whether it is permissible under the applicable legislation to give a single consent to carry out the processing of personal data for the purpose of direct marketing of the products of V. Sp. z o.o. and other entities belonging to the "[...]" capital group and the use of telecommunications terminal equipment and automatic calling systems for the purpose of such marketing, referred to in Article 172(1) of the Act of 16 July 2004. Telecommunications Law. Pursuant to Article 23 (1) (1) of the Act of 29 August 1997 on the protection of personal data (Journal of Laws of 2016, item 922), the processing of personal data is permitted when the data subject consents to it, unless it concerns the deletion of data concerning him. On the other hand, Article 172(1) of the Telecommunications Law (Journal of Laws of 2016, item 1489, as amended), implies the prohibition to use telecommunications terminal equipment and automatic calling systems for the purposes of direct marketing, unless the subscriber or user consents to it. As the Court of First Instance aptly explained, consent may cover various purposes of processing personal data. When processing personal data, the person whose personal data will be used should be provided with maximum legal protection, especially if the data will be used for marketing purposes. The person should be given the possibility to give his or her consent not only in a yes/no way, but in an 'extended consent' relating to specific fields of use of the data concerned. Such a choice is not ensured by the practice applied by the Company disclosed in the proceedings before the Inspector General for the Protection of Personal Data because the person granting the consent may not grant it only partially. For this reason, it is reasonable to provide the customer with an optionality of giving consent to the processing of personal data by the Company cooperating with other entities. The inclusion of several consents in the content of one statement results in the lack of possibility to choose the consent to be given. This means that the data subject does not have full freedom to dispose of his/her personal data. According to Article 23 (1)(1) of the Act on the Protection of Personal Data, giving the consent to process the data for marketing purposes constitutes the prerequisite of the legality of processing of personal data by the controller, and the consent is independent of the means by which the marketing is directed and should be separated from the means of direct marketing. In the present case, from the requirements indicated in Article 172, paragraph 1 of the Telecommunications Law. An entity asking a natural person to give such consent must do so in a clear, unambiguous manner, distinguishing it from other information and statements coming from that entity. The person giving his/her consent must understand the essence of the consent, its purpose and effects, and therefore must have a full understanding of precisely by whom and for what specific purpose his/her data will be processed.
The applicant's assertion that it is irrelevant which entities are the subject of the consent is incorrect. In the circumstances of this case, this is just as important as the purposes for which the personal data is collected. The client should know which entities are covered by the consent and have a choice in this respect. In the case at hand, the construction of the disputed clause, which introduces an unnecessary requirement of consent for marketing of the Company's products and services, may for example create doubts on the part of customers as to the desired marketing of the Company's products and services - in a situation when they do not consent to marketing of products and services of other entities belonging to the "[...]" group. Nor can it be assumed, as the applicant claims, that the customers are aware of the objects of the entities of the '[...]' group and, consequently, that they know what information they will receive regarding the products and services of those entities.

It is also impossible to agree with the position of the Company, from which it follows that the analysis of the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter "RODO"), indicates that the most important is the purpose for which consent to the processing of personal data is obtained and it is not important to indicate the entities for the benefit of which the obtained data will be processed. It should be pointed out that, as rightly claimed by the body in the reply to the cassation appeal, recital 42 of the preamble to the PDO specifies the conditions which should be met for the data processing to take place on the basis of consent. Firstly, the controller should be able to demonstrate that the data subject has given his consent to the processing operations. Secondly, in case of a declaration made in another matter, there should be guarantees that the data subject is aware of the consent and its scope. Thirdly, the statement should be in an intelligible and easily accessible form, drafted in clear and plain language, and should not contain unfair terms. Fourthly, the data subject should at least know the identity of the controller and the intended purposes of the processing of the personal data in order to give informed consent. Fifthly, if the data subject has no effective or free choice and cannot refuse or withdraw consent without adverse consequences, consent cannot be deemed to be freely given. When analysing the above regulations, it should be noted that the existing doctrine and judicature have developed standards which are basically repeated in the quoted recital of the preamble to the General Data Protection Regulation.

To conclude, in the context of the provisions on personal data protection, there is a requirement to ensure that the decision to consent to the processing of personal data for a specific purpose is taken freely and is independent, it must be a manifestation of free and unfettered will of the person concerned, i.e. it cannot be forced by the necessity to make other declarations of will. The aforementioned requirements are not met by the clause proposed by the Company to its clients. Therefore, one cannot agree with the allegation that in the case in question the authority breached Article 23(1)(1) of the Act for the Protection of Personal Data by holding that the content of the consent to processing data for marketing purposes contained in the clause referred to does not allow to make a conscious and free declaration of will. It follows from the cited clause that the proposed consent does not give the possibility to choose between the marketing of products and services of the Company as data controller and products and services of other entities not specified individually. Contrary to the applicant's position, it is also important that one consent concerns two independent legal grounds contained in different acts. As a result, it should be concluded that the consent pertains to various purposes of personal data processing, i.e. marketing of products and services of the Company, marketing of products and services of other entities and the possibility of using telecommunication terminal equipment and automatic calling systems for marketing. It should be added here that although the Company is exempted from obtaining consent for marketing of its own products and services, it is clear from the quoted clause that the consent is also to cover marketing of the Company's products and services. In addition, it should be noted that in order for the Company to conduct direct marketing of its products and services using telecommunications terminal equipment and automatic calling systems to process personal data, it must obtain the consent of customers and potential customers pursuant to Article 172(1) of the Telecommunications Law. Therefore, it should be assumed that if, as in the case in question, the consent is to relate to various issues concerning the processing of personal data, the consent should be expressed separately for each of them.

The arguments included in the justification of the cassation appeal regarding Article 23 (1)(5) in connection with Article 23 (4)(1) of the Act on the Protection of Personal Data with regard to direct marketing of the Company's products and services should be regarded as incomprehensible, as both the authority and the Court did not question the possibility to conduct such marketing without the consent of the clients. Obviously, with the exception of marketing with the use of telecommunication terminal equipment and automatic calling systems.
As regards the claim of the applicant that the Court finds that the provision of Article 172(1) of the Telecommunications Act is not related to the manner in which the processing of personal data occurs, it must be firmly stated that the Court and the authority did not raise such an argument at any stage of the proceedings. Instead, the authority indicated that the consent referred to in Article 172(1) of the Telecommunications Law cannot be implied from the consent under Article 23(1)(1) of the Act on the Protection of Personal Data and vice versa. For these two consents concern different issues and result from different legal acts. Admittedly, it may be assumed that the marketing conducted by the Company is based on "one and the same action", but the requirement of clause clarity (i.e. the customer's awareness of what he/she consents to) makes the consent provided for in Article 172 (1) of the Telecommunications Law should be distinguished. Contrary to the Company's claims, the latter consent is not the same as the consent under Article 23 (1) (1) of the Personal Data Protection Act. In conclusion, the allegation of a violation of Article 172, paragraph 1 of the Telecommunications Law is also not well-founded.

The allegation of infringement of Article 23 (1) (5) of the Act on the Protection of Personal Data is also unfounded as the Company claims that the Court erroneously assumed that this provision does not apply to the provisions of the clause submitted to the customers in the part - 'for direct marketing of products and services of entities belonging to the capital group '[...]'. Pursuant to Article 23 (1) (5) of the Act on personal data protection, the processing of data is admissible if it is necessary for the fulfilment of legally justified purposes carried out by the controllers or recipients of data, and the processing does not violate the rights and freedoms of the data subject. However, pursuant to Article 23 paragraph 4 point 1 of the Act the legally justified purpose referred to in paragraph 1 point 5 shall be in particular direct marketing of own products or services of the controller. Therefore, there is no doubt raised by the Supreme Administrative Court that the provision of Article 23 (1) (5) of the Act on the Protection of Personal Data does not constitute the legal basis for marketing by the Company to others, i.e. entities belonging to the capital group "[...]" without the express consent of its customers. The processing of personal data by the Company for the purpose of marketing to other entities should take place only with the consent of the data subject, i.e. pursuant to Article 23 (1) (1) of the Act on the Protection of Personal Data.

As regards the allegation concerning the order to stop processing personal data of persons applying for a loan through: R. SA and the following brokers: Dom Finansowy [...], F. SA, K. and H. Sp. z o.o., with regard to: family name, parents' names, date of issue of the identity card and the name of the authority which issued it, image, height, eye colour, place of birth, mother's maiden name, as inadequate for the purpose for which the data are processed, i.e. identification of the identity of the abovementioned persons prior to conclusion of the loan agreement, the Board of Appeal issued an order to cease processing the personal data of the persons who applied for the loan before conclusion of the loan agreement, i.e. pursuant to Article 23(1) of the Act on Personal Data Protection. persons before the conclusion of the loan agreement, it should be pointed out that it results from the findings of the authority approved by the Court of First Instance and not challenged in the cassation appeal that in the case of submitting an application through a broker or R. SA, an agent cooperating with the broker or an employee of an outlet of R. SA is involved in the process of submitting the application. Such persons are contacted directly by the applicant submitting the loan application and, therefore, the identity of the applicant should be confirmed on the basis of the identity card presented. Therefore, the subsequent verification of the applicant's identity by the Company's employees on the basis of a scan of the identity card is unjustified. Due to the fact that the cash appeal does not raise the charges of infringement of the provisions of proceedings regulating the establishment of facts, the Company's statements included in the justification of the cash appeal, referring to the purpose of processing of the data included in the identity cards of the customers by the Company, other than determined by the authority, have no impact on the outcome of the case.
It should further be recalled that the injunction contained in point I. 2. of the decision of [...] February 2017 does not concern the lack of a legal basis for the Company's processing of personal data in the scope of family name, parents' first names, date of issuance of the identity card and the name of the authority which issued it, image, height, eye colour, place of birth, mother's maiden name, as this order refers to the issue of processing of the aforementioned data in a scope inadequate to the purpose for which the data are processed, i.e. for the purpose of verification of the identity of the person applying for a loan. As the authority aptly argues in its reply to the cassation appeal, this argumentation is also justified by the currently applicable provisions of the RODO, i.e. Article 5(1)(c), according to which personal data must be adequate, relevant and limited to what is necessary for the purposes for which they are processed ('data minimisation'). The principle of data minimisation has been mentioned among other principles of personal data processing such as purpose limitation and accuracy. The principle of personal data minimisation is inextricably linked to the purposes for which personal data are to be processed. The RODO requires the data collector and processor (personal data controller) to only collect and use data that is genuinely compatible with the purposes that it wishes to achieve with the personal data. In other words, the personal data controller is obliged to collect only such data as are necessary for the specific purpose of the processing. Furthermore, under the RODO, the controller is responsible for, inter alia, compliance with the principle of minimisation and must be able to demonstrate such compliance (Article 5(2) of the RODO).

As a consequence of the above, the allegation of violation of Art. 23(1)(3) and Article 26(1)(3) of the Act on the Protection of Personal Data.

The arguments contained in the justification of the cassation complaint with regard to Article 23 paragraph 1 point 2 of the Act on the Protection of Personal Data shall be considered irrelevant, since this provision has not been indicated as infringed in any of the grounds for cassation. Moreover, contrary to the claims of the author of the cassation appeal, this provision was not interpreted by the Court of First Instance, still less could it have been misinterpreted, nor was it applied by that Court. That Court also did not interpret, as if related to this provision, provisions of the Law on Counteracting Money Laundering and Financing of Terrorism, the Law on Consumer Credit, the Law on Providing Access to Business Information and Exchange of Business Data, the Banking Law and the Regulation of the Minister of Finance of 23 June 2016 on the Detailed Scope of Data to be Exchanged between Institutions Established under Banking Law and Loan Institutions and Other Entities, not specifically identified in the cassation appeal.

Bearing in mind the foregoing arguments, the Supreme Administrative Court held that the cassation appeal has no justified grounds and therefore, pursuant to Article 184 p.p.s.a., dismissed it.