NSA - III OSK 2184/22

NSA - III OSK 2184/22
Court:	NSA (Poland)
Jurisdiction:	Poland
Relevant Law:	Article 78(2) GDPR Article 35 kodeks postępowania administracyjnego (administrative procedure code )
Decided:	25.09.2024
Published:
Parties:	Ubezpieczeniowy Fundusz Gwarancyjny
National Case Number/Name:	III OSK 2184/22
European Case Law Identifier:
Appeal from:	UODO (Poland)
Appeal to:	Appealed - Confirmed WSA Warsaw (Poland) II SAB/Wa 60/22
Original Language(s):	Polish
Original Source:	Centralna Baza Orzeczeń Sądów Administracyjnych (in Polish)
Initial Contributor:	wp

The Supreme Administrative Court found that, under Article 78(2) GDPR, the DPA was obliged to examine a case and issue a decision within three months.

English Summary

Facts

A data subject filed a complaint with the Polish DPA (UODO) in September claiming that an insurance company (the controller) unlawfully processed and transferred their personal data to the Insurance Guarantee Fund (Ubezpieczeniowy Fundusz Gwarancyjny). Under the Polish law, the Insurance Guarantee Fund held register of insured entities.

The DPA asked the controller and the Insurance Guarantee Fund to make statements regarding the complaint.

In December, the data subject filed a statement, lamenting the DPA's alleged inactivity and prolongation of the proceedings. Also, the data subject asked for the copies of all documents sent to the DPA by the controller and the Insurance Guarantee Fund.

The DPA refused to provide the data subject with such copies and continued to process the case.

The data subject filed a complaint with the Voievodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie), claiming proceedings were prolonged by the DPA's inactivity. In the meantime, the DPA issued a decision.

The court upheld the complaint against the DPA inactivity. According to the court, the DPA proceeded the case with protraction. There was no extenuating circumstances explaining the fact that the DPA examined the case for four months. Thus, the DPA violated Article 35 of administrative procedure code (kodeks postępowania administracyjnego) according to which in principle, DPA's should render their decision in one month.

The DPA lodged the cassation appeal with the Supreme Administrative Court (Naczelny Sąd Administracyjny). The DPA stood on a position that it was Article 78(2) GDPR that determined the terms to examine the case.

Holding

The court upheld the DPA's appeal.

Article 78(2) GDPR was applicable to the case at hand. The three months term of Article 78(2) GDPR determined the time, in which the DPA was obliged to examine the case and issue a decision. Thus, Article 78(2) GDPR was a lex specialis, derogating the application of the general terms for case examination. Nevertheless, it was the DPA’s duty to inform the data subject about a delay in the closing of the case and its status, in accordance with Article 36 of administrative procedure code.

If the DPA didn’t issues decision within three months, the data subject was entitled to bring a case for delayed proceedings by the DPA. However, the court of first instance failed to consider the DPA proceedings under Article 78(2) GDPR. Because of that, the case was sent back to the Voievodeship Administrative Court of Warsaw.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.

Date of judgment

2024-09-25 final judgment

Date of receipt

2022-09-05

Court

Supreme Administrative Court

Judges

Hanna Knysiak - Sudyka /rapporteur/
Rafał Stasikowski
Tamara Dziełakowska /chairperson/

Symbol with description

647 Cases related to personal data protection
658

Thematic entries

Personal data protection

Related references

II SAB/Wa 60/22 - Judgment of the Provincial Administrative Court in Warsaw of 2022-06-08

Accused body

Inspector General for Personal Data Protection

Content of the result

The contested judgment was set aside in part and the case was referred for reconsideration by the Provincial Administrative Court

Referenced provisions

Journal of Laws 2022 item 329 art.149 par.1 point 3
Act of 30 August 2002 - Code of Administrative Court Procedure - consolidated text

Journal of Laws 2021 item 735 art.35 par.1 and 3
Act of 14 June 1960 - Code of Administrative Procedure - consolidated text

Sentence

Supreme Administrative Court composed of: Presiding Judge: Supreme Administrative Court Judge Tamara Dziełakowska Judges: Supreme Administrative Court Judge Rafał Stasikowski Judge del. WSA Hanna Knysiak-Sudyka (rapporteur) Clerk of the Court: assistant judge Adam Płusa after considering on September 25, 2024, at a hearing in the General Administrative Chamber, the cassation appeal of the President of the Personal Data Protection Office against points 1, 2 and 4 of the judgment of the Provincial Administrative Court in Warsaw of June 8, 2022, file reference II SAB/Wa 60/22 in the case of the complaint of M. K. regarding the excessive length of the proceedings conducted by the President of the Personal Data Protection Office regarding the consideration of a complaint regarding the processing of personal data 1. quashes the contested judgment in points 1, 2 and 4 and in this respect refers the case for reconsideration to the Provincial Administrative Court in Warsaw, 2. awards M. K. the amount of PLN 460 (four hundred sixty) from the President of the Personal Data Protection Office as reimbursement of the costs of the cassation proceedings. Justification

The Provincial Administrative Court in Warsaw, in its judgment of 8 June 2022, file reference II SAB/Wa 60/22, after considering the case of the complaint of M. K. regarding the excessive length of the proceedings by the President of the Personal Data Protection Office regarding the consideration of the complaint of [...] September 2021 regarding the processing of personal data, found that the President of the Personal Data Protection Office had excessive length of the proceedings in the case of the complaint of M. K. regarding the processing of personal data (point 1), found that the excessive length of the proceedings did not constitute a gross violation of the law (point 2), dismissed the complaint in its remaining scope (point 3), and also awarded the amount of PLN 100 from the President of the Personal Data Protection Office to the complainant M. K. as reimbursement of the costs of the proceedings (point 4).

The judgment was issued in the following factual and legal circumstances of the case.

On September 20, 2021, the President of the Personal Data Protection Office (hereinafter: "President of the Personal Data Protection Office", "authority") received a complaint from M. K. (hereinafter: "complainant"), dated September 13, 2021, regarding irregularities in the processing of his personal data by P. S.A. with its registered office in Warsaw (hereinafter: "P.") consisting in the processing of his personal data without a legal basis and their disclosure to the Insurance Guarantee Fund (hereinafter: "UFG").

In letters dated October 25, 2021, the President of the UODO called on P. and UFG to respond to the content of the complaint and submit written explanations. At the same time, in a letter dated the same date, he informed the complainant that he had contacted the above-mentioned entities.

The explanations from UFG were received by the body on 3 November 2021, while on 4 November 2021, P.'s application was received to extend until 10 December 2021 the deadline for providing the information and documents required in the case in connection with the scope of information necessary to collect in the case in question and the circumstances related to the epidemic situation significantly affecting the organizational changes in the functioning of the entity.

On 3 December 2021, the President of the UODO received a reminder from the complainant, in which he requested a statement that there had been inaction and delay in the administrative proceedings with a gross violation of the law. At the same time, in this letter, the complainant requested that certified copies of the documents contained in the case files be sent before the decision was issued.

On December 13, 2021, the authority received explanations from P.

In letters dated December 22, 2021, the President of the UODO informed the parties about the collection of evidence sufficient to issue an administrative decision, about the possibility of commenting on the evidence and materials collected during the proceedings and the requests submitted, and about the possibility of inspecting the case files at the authority's headquarters, setting a deadline of 7 days for the implementation of the above rights, from the date of receipt of this letter.

At the same time, by order of December 22, 2021, the President of the UODO refused to take into account M. K.'s request to send certified copies of the files of the case in question.

On December 23, 2021, M. K. filed a complaint with the Provincial Administrative Court in Warsaw.

In response to the complaint, the President of the UODO requested its dismissal, considering that in the current legal and factual situation, this complaint is unfounded.

The Voivodship Administrative Court in Warsaw, in the above-mentioned judgment, found that the complaint was justified and deserved to be upheld.

In justifying its position, the Court of First Instance indicated that it did not share the position of the President of the Personal Data Protection Office that the provision of Article 78 sec. 2 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as "GDPR") is a special provision in relation to the provisions of the Code of Administrative Procedure, and thus this body is not bound by the deadlines for handling the case specified in the Act of 14 June 1960, the Code of Administrative Procedure (Journal of Laws of 2021, item 735, as amended, hereinafter referred to as "k.a."), but is only obliged to inform the party about the actions taken in its case at intervals not exceeding three months.

According to the Provincial Administrative Court in Warsaw, the provision in question is in connection with Article 77 paragraph 2 of the GDPR and Article 57 paragraph 1 letter b. f GDPR, which refers to informing the complainant - within a reasonable period of time - about the progress and results of the proceedings, in particular if it is necessary to continue the proceedings or coordinate activities with another supervisory authority. The provision of art. 78 sec. 2 GDPR itself gives every data subject the right to an effective legal remedy before a court - without prejudice to other administrative or extrajudicial legal remedies - if the supervisory authority (President of the Personal Data Protection Office) has not considered the complaint or has not informed the data subject, within three months, about the progress or effects of considering the complaint filed in accordance with art. 77.

The court of first instance emphasized that art. 60 of the Act of 10 May 2018 on the protection of personal data provides that the proceedings on the infringement of the provisions on the protection of personal data, hereinafter referred to as the "proceedings", are conducted by the President of the Office. There is no doubt that the proceedings on the infringement of the provisions on the protection of personal data are one of the administrative proceedings before the President of the Personal Data Protection Office. Its nature is determined by art. 7 sec. 1 of the aforementioned Personal Data Protection Act, which qualifies proceedings from chapters 4-7 and 11 of this Act as administrative and provides for the application of the Code of Administrative Procedure to these proceedings in matters not regulated therein. It should be noted that the legislator in art. 7 sec. 1 of the cited Act does not provide for the application of the relevant one, which means that the provisions of the Code of Administrative Procedure are applied directly, with modifications resulting from the regulations of the Personal Data Protection Act.

The Provincial Administrative Court in Warsaw found that the proceedings in the matter of considering the complaint of M. K. regarding the processing of his personal data by Powszechny Zakład Ubezpieczeń S.A. and the Insurance Guarantee Fund were conducted in a protracted manner. In the Court's opinion, the manner in which the body proceeded in this case indicates a violation of the principle of speed and efficiency of administrative proceedings. It is impossible to approve a situation in which the body, conducting such limited explanatory proceedings, does not deal with the party's complaint for a period of over 4 months.

The Court of First Instance noted that the GDPR does not contain provisions separate from the Code of Administrative Procedure regarding the deadlines for resolving a case, and does not exclude the application of the provisions of the Code of Administrative Procedure. Therefore, a case requiring explanatory proceedings should be resolved no later than within one month, and a particularly complex case - no later than within two months from the date of initiation of the proceedings (Article 35 § 3 of the Code of Administrative Procedure). The extensiveness of the complaint filed by M. K. to the President of the UODO, the need to examine the validity of the issues raised in it and to conduct a thorough analysis of the factual circumstances of the case, do not exempt from the charge of lengthy conduct of the proceedings. This view is consistent with the generally accepted principle that the implementation of the competences of a public administration body is its legal obligation, from which it is not exempted by so-called objective difficulties, e.g. the complexity of the case.

Due to the issuance of a decision in the case, the Court had no grounds to oblige the body to consider M. K.'s complaint pursuant to Article 149 § 1 point 1 of the Act of 30 August 2002 - The Code of Administrative Court Procedure (Journal of Laws of 2022, item 329, as amended, hereinafter referred to as: "p.p.s.a."), however, found that the body had been guilty of excessively lengthy conduct of the proceedings - in accordance with art. 149 § 1 point 3 of the p.p.s.a. At the same time, the Court found that the excessively lengthy conduct of the proceedings did not constitute a gross violation of the law.

A cassation appeal against this judgment was filed by the President of the Personal Data Protection Office, appealing against the judgment in part in the scope of points 1, 2 and 4 and accusing it of violating the provisions of the procedure having a significant impact on the outcome of the case, i.e. art. 149 § 1 point 3 of the p.p.s.a. in conjunction with art. 35 § 1 and § 3 of the Code of Administrative Procedure, by erroneously assuming that the above provisions of the Code of Administrative Procedure apply in this case, while Article 78 paragraph 2 of the GDPR applied to determining the deadline for resolving the case in question.

Taking the above into account, the appellant filed a motion to set aside the contested judgment in its entirety and for the cassation appeal to be considered by the Supreme Administrative Court, or alternatively to set aside the contested judgment in its entirety and refer the case back to the Provincial Administrative Court in Warsaw for reconsideration. At the same time, the authority filed a motion to award reimbursement of the costs of the proceedings in accordance with the applicable rules, as well as to consider the cassation appeal at a hearing.

The above allegations were developed in the justification of the cassation appeal.

No response to the cassation appeal was filed.

The Supreme Administrative Court considered the following:

Pursuant to art. 183 § 1 of the p.p.s.a., the Supreme Administrative Court shall examine the case within the limits of the cassation appeal, taking into account ex officio only the invalidity of the proceedings. In the case being examined, none of the circumstances resulting in the invalidity of the proceedings, as referred to in art. 183 § 2 of the p.p.s.a., occur. and none of the premises referred to in art. 189 p.p.s.a., which the Supreme Administrative Court considers ex officio when reviewing the judgment appealed against in the cassation appeal, apply.

In these circumstances, only the objection raised in the cassation appeal to justify the cited basis for the cassation appeal was subject to examination in the case. The Supreme Administrative Court found that the cassation appeal filed was justified.

It should be noted that in accordance with art. 78 sec. 2 of the GDPR "Without prejudice to other administrative or extrajudicial remedies, every data subject shall have the right to an effective remedy before a court if the supervisory authority competent in accordance with art. 55 and 56 has not considered the complaint or has not informed the data subject within three months of the progress or effects of the consideration of the complaint filed in accordance with art. 77." In the doctrine, one can find the view that "In accordance with art. 35 § 4 of the Code of Administrative Procedure, special provisions may specify other deadlines than those indicated in the content of this article. However, art. 78 sec. 2 of Regulation 2016/679 GDPR is not such a special provision, as it does not specify the deadline for handling a complaint by the supervisory authority. The three-month deadline referred to in this provision refers to the performance by the supervisory authority of the obligation to inform the data subject about the progress and effects of considering their complaint, and the GDPR connects its expiry with the possibility for the data subject to initiate legal remedies before a court - to file a complaint against the inaction of the supervisory authority" (cf.: I. Bogucka (in:) Personal Data Protection Act. Commentary, D. Lubasz (ed.), Warsaw 2019, art. 62). This view seems to be shared by the Court of First Instance.

The above views of the representatives of the legal doctrine have not been shared in the case law (see the judgments of the Supreme Administrative Court of 7 July 2023, file reference III OSK 5190/21, III OSK 4754/21 and III OSK 1959/22). The Supreme Administrative Court, in the composition adjudicating this case, fully shares the views expressed in the above judgments, adopting them as its own.

Taking into account the essence of the problem in the case and the arguments raised by the authority, it should be emphasized that the three-month period under Article 78 paragraph 2 of the GDPR does not refer only to the obligation to inform the data subject about the progress or effects of the consideration of the complaint filed in accordance with Article 77 of the GDPR, but primarily refers to the consideration of the complaint, which results from the content of the provision ("if the supervisory authority competent in accordance with Articles 55 and 56 has not considered the complaint or has not informed..."). Consideration of a complaint within the meaning of art. 78 sec. 2 of the GDPR in conjunction with art. 7 sec. 1 of the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2019, item 1781 as amended), hereinafter referred to as the Personal Data Protection Act, means the issuance of an administrative decision. Therefore, it is not justified to claim that art. 78 sec. 2 of the GDPR does not set a time limit for dealing with an administrative case. Since the expiry of the three-month period referred to in art. 78 sec. 2 of the GDPR entitles you to lodge a complaint about inaction (as the above-mentioned doctrine argues; see also P. Fajgielski (in:) Commentary to the Personal Data Protection Act (in:) General Data Protection Regulation. Personal Data Protection Act. Commentary, 2nd ed., Warsaw 2022, art. 62, note 4) - and inaction is related to the failure to deal with the case within the time limit specified in art. 35 k.p.a. or special provisions or within the period specified in accordance with art. 36 § 1 k.p.a. (see art. 37 § 1 item 1 k.p.a.) - then the period from art. 78 sec. 2 of the GDPR must be treated as a special period, within the meaning of art. 35 § 4 k.p.a.

In the opinion of the Supreme Administrative Court, art. 78 sec. 2 of the GDPR should therefore be interpreted in such a way that the obligation of the supervisory authority to inform the data subject within three months about the progress or effects of the complaint review becomes relevant if the complaint has not been reviewed within this period (i.e. an administrative decision has not been issued) and there is a need to extend it, in accordance with art. 36 k.p.a., which corresponds to art. 62 of the Administrative Procedure Code, which additionally requires informing the parties about the status of the case and the activities carried out in such a situation. According to art. 62 of the Administrative Procedure Code, "In the case referred to in art. 36 of the Act of 14 June 1960 - the Code of Administrative Procedure, the President of the Office, when notifying the parties about the failure to resolve the case on time, is also obliged to inform about the status of the case and the activities carried out in its course." 

Obviously, there is nothing to prevent a given entity from filing a complaint about the excessive length of the proceedings if the proceedings are conducted longer than necessary to resolve the case (art. 37 § 1 item 2 of the Administrative Procedure Code). However, the Court of First Instance, when assessing the validity of the complaint regarding the excessive length of the proceedings, relied on an incorrect legal basis, and thus did not consider the substance of the case, which prevents the Supreme Administrative Court from learning the real reasons for the decision. 

In view of the above, the Supreme Administrative Court, pursuant to Article 185 § 1 of the Code of Administrative Procedure, repealed the contested judgment in points 1, 2 and 4 and referred the case in this respect to the Provincial Administrative Court in Warsaw for reconsideration. When reconsidering the case, the Provincial Administrative Court will take into account the legal assessment presented above.

The costs of the proceedings were ruled on the basis of Article 203 point 2 of the Code of Administrative Procedure, according to which the party that filed the cassation appeal is entitled to reimbursement of the necessary costs of the cassation proceedings incurred by it from the appellant - if, as a result of upholding the cassation appeal, the judgment of the court of first instance upholding the complaint was repealed.