NSA - III OSK 4727/21

NSA - III OSK 4727/21
Court:	NSA (Poland)
Jurisdiction:	Poland
Relevant Law:	Article 6(1) GDPR Article 9(2) GDPR
Decided:	13.07.2021
Published:
Parties:
National Case Number/Name:	III OSK 4727/21
European Case Law Identifier:
Appeal from:	WSA Warsaw (Poland) II SA/Wa 781/20
Appeal to:
Original Language(s):	Polish
Original Source:	Centralna Baza Orzeczeń Sądów Administracyjnych (in Polish)
Initial Contributor:	Agnieszka Rapcewicz

The Polish Supreme Administrative Court upheld an order by the Polish DPA, which required a health care institution to delete personal data concerning a former employee. Whilst the institution wanted to store the data in case of future civil litigation, the Court held that the processing of personal data for this reason lacks a legal basis under Article 6(1) and Article 9 GDPR.

English Summary

Facts

The Polish DPA issued a decision ordering a health care institution to delete the personal data of a former employee stored on the hard drive of the company computer which he used during his employment. The DPA concluded that, in the present case, none of the prerequisites of Article 6(1) and Article 9(2) GDPR authorising the health care institution to process the complainant's personal data after termination existed. The health care institution argued that it needed to process the personal data of former employees in order to defend itself against possible civil claims, but the DPA explained that such a reason does not have legal justification as a basis for processing under the GDPR. Personal data cannot be processed 'as a back-up' with the assumption that the data may be useful in the future, and stored up until the statute of limitations for civil law claims. The DPA held that there were no grounds entitling the employer to process the data to defend itself from hypothetical claims in the future.

This decision was appealed by the health institution to the Voivodship Administrative Court in Warsaw, which dismissed the complaint. The appellant further appealed against the judgment to the Supreme Administrative Court and requested that the contested decision be suspended. The appellant claimed that it was necessary to suspend the execution of the contested decision, since its execution would produce effects for the applicant which are impossible to reverse (via the destruction of potential evidence).

Holding

The Polish Supreme Administrative Court sided with the Polish DPA, and held that the appellant did not prove premises justifying the suspension of the execution order of the appealed decision issued by the DPA. It held that reference to the processing of the complainant's personal data in order to defend against any claims is not legally justified and does not constitute a premise entitling to the processing of personal data.

In the opinion of the Court, the risk of the possibly erroneous classification of the processing of personal data by the applicant as unlawful does not justify the suspension of the execution of the decision ordering the removal of personal data of the participant in the proceedings. Through a sort of balancing test, it reasoned that the risk to the rights of the data subject if the data is stored is greater than the risk to the applicant if the data is deleted.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.

Date of the judgment
2021-07-13
final judgment
Date of receipt
2021-04-28
court
The Supreme Administrative Court
Judges
Rafał Stasikowski / chairman rapporteur /
Symbol with description
647 Matters related to the protection of personal data
Ref. linked
II SA / Wa 781/20 - Judgment of the Provincial Administrative Court in Warsaw of 2020-11-16
The appealed authority
Inspector General for Personal Data Protection
Result content
The application for a stay of implementation of the contested decision was dismissed
Sentence

Supreme Administrative Court composed of: Chairman Judge of the Supreme Administrative Court Rafał Stasikowski, after considering on July 13, 2021, at a closed session in the General Administrative Chamber, the motion to suspend the execution of the appealed decision on the cassation appeal [..] of Zespół Opieki Zdrowotnej im. [..] against the judgment of the Provincial Administrative Court in Warsaw of November 16, 2020, file ref. no. II SA / Wa 781/20 on a complaint [..] by Zespół Opieki Zdrowotnej im. [..] on the decision of the President of the Personal Data Protection Office of [..] February 2020, No. [..] on the order to delete personal data, he decides to: dismiss the application
Justification

By the judgment of November 16, 2020, file ref. no. II SA / Wa 781/20 The Provincial Administrative Court in Warsaw dismissed the complaint [..] of the Healthcare Team [..] against the decision of the President of the Personal Data Protection Office of [..] February 2020 regarding the order to delete personal data. A cassation appeal against this judgment was filed by [..] Zespół Opieki Zdrowotnej im. [..]. The cassation appeal contained a motion to stay the execution of the appealed decision. In the justification of the request it was argued that suspending the execution of the contested decision is necessary because its execution would cause the complainant to have irreversible effects - deletion of the data from the data carrier would be irretrievably performed, therefore, even a ruling of the Supreme Administrative Court, which was favorable to the complainant, would prevent the complainant from further processing of personal data on the medium, because the data would not be recoverable and the occurrence of circumstances which, if the Supreme Administrative Court recognizes the cassation appeal as justified, will condition the criminal, civil and administrative liability of the complainant for the deletion of personal data on the medium, and, moreover, criminal proceedings are conducted before with the District Court in J., file no. act [.], where the medium constitutes evidence in the proceedings. The applicant submitted that the implementation of the decision would prevent him from fulfilling his legal obligations and tasks related to public tasks specified in the Act on archives. Therefore, if the complainant first removed the personal data from the carrier, and then the contested decision was annulled by a judgment, the processing of the participant's personal data stored on the carrier would be discontinued as pointless, as no decision (even favorable to the complainant) regarding the processing of such data could be issued. personal data, as this processing will no longer be possible for factual reasons (no data). The discontinuation of the proceedings will consequently lead to the recognition that the personal data were processed in an unlawful manner and it was necessary to remove them from the carrier, and this action will condition criminal liability in criminal proceedings. that the ratio legis of the provisions of the European Union is absolute protection of the personal data of a natural person, and their processing may only take place on the basis and within the limits of the law, and the complainant is not able to prove that the processing of the participant's data results from the legitimate interests of the administrator. weighed as follows: Pursuant to Art. 61 § 3 of the Act of 30 August 2002 - Law on proceedings before administrative courts (Journal of Laws of 2019, item 2325, as amended, hereinafter referred to as "Ppsa"), the court may, at the request of the complainant, suspend the execution in full or in part of the act or activities referred to in § 1, if there is a risk of causing significant damage or causing effects that are difficult to reverse. Granting the applicant temporary protection in administrative court proceedings constitutes a derogation from the general rule expressed in Art. 61 § 1 of the PPA, according to which the lodging of a complaint does not suspend the execution of the challenged act or action. The conditions which should be followed by the court when adjudicating on a motion to stay the execution of the challenged act or activities in an exhaustive manner are set out in Art. 61 § 3 P.p.s.a., according to which they are: the risk of causing significant damage or causing effects that are difficult to reverse. These conditions should be related to the situation that may arise when the administrative act challenged to the court is executed, and then, as a result of granting the complaint, the act is upset. According to the established jurisprudence of the Supreme Administrative Court, it is up to the party to prove the existence of these premises (see, for example, post by the Supreme Administrative Court of May 26, 2021, file reference number III OZ 380/21). mentioned in the above-mentioned provision is to provide the complainant with temporary protection in the course of the judicial review of the complained act against the consequences of defective acts or actions of public administration bodies, the execution of which may lead to significant damage or effects difficult to reverse. Since the procedural institution for suspending the execution of a decision is a departure from the general principle of its enforceability and is intended to protect a party to the proceedings, protecting it against the negative effects that may arise as a result of the execution of a decision, then, as a consequence, the grounds for suspending the execution of the contested act or action should not be interpreted broadly. Leaving by the legislator to the discretion of the Court of the legitimacy of suspending the act requires a particularly thorough and convincing justification by the complainant of the motion demonstrating the need to suspend the execution of the act, especially since at this stage of the proceedings the court does not examine the merits of the complaint. It is therefore about damage and qualified effects, i.e. those exceeding the normal consequences related to the implementation of the act (such as the decision of the Supreme Administrative Court of December 22, 2004, file reference number OZ 889/04; the decision of the Supreme Administrative Court of December 8, 2004). no. OZ 694/04; decision of the Supreme Administrative Court of 9 March 2005, file reference number II OZ 52/05). argues in favor of the dismissal of the applicant's request. It is necessary to take into account the nature of the contested decision, in which the authority ruled that the complainant allowed the processing of personal data of a participant in the proceedings in breach of applicable law. The authority pointed out that in the case none of the prerequisites under Art. 6 sec. 1 and art. 9 sec. 2 of the Regulation of the European Parliament and of the Council of the European Union 2016/679 of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (Journal of Laws UE. 2016.119 .1. And Journal of Laws UE.L. 2018.127.2) authorizing [...] to process the complainant's personal data contained on the hard drive of the company computer after the termination of his employment. The reference by [...] to the processing of the complainant's personal data in order to defend against any claims is not legally justified and does not constitute a premise entitling to the processing of personal data. The authority drew attention to the breach of the law by the complainant in connection with the processing of personal data of a participant in the proceedings stored on the hard drive of the official computer, i.e. a violation of Art. 6 sec. 1, art. 9 sec. 2 and art. 17 sec. 1 lit. a and b of the above-mentioned regulation. In the opinion of the Supreme Administrative Court, the risk related to the possible incorrect classification of the processing of personal data by the complainant as unlawful does not justify suspending the execution of the decision ordering the deletion of the participant's personal data. The requested decision is a specific decision. The authority stated in it that there had been unauthorized processing of personal data and that this state had to be eliminated, as the essence of data protection implies the need to remove it. The basic principle related to the processing of personal data is the principle of lawfulness, in other words, the legality of processing, formulated in art. 5 lit. and Regulation 2016/679, which is detailed, giving it a normative content, the provisions of art. 6 and 9 of Regulation 2016/679, on the basis of which the authority issued a decision ordering the deletion of personal data. The principle of legality means that the processing of personal data is possible only when the person performing activities in this area does so based on one of the conditions for data processing provided for in the law. The lack of this premise in relation to the applicant's actions was accused of the applicant in this case by the public administration authority which ordered the deletion of the participant's personal data stored on the hard drive of his business computer, after the applicant's employment status ceased. for the purpose of provisional protection in administrative court proceedings, provided for in Art. 61 § 3 P.p.s.a. is to protect the applicant against the negative effects of the execution of the decision specified in this provision until the end of the administrative court review, however, it should be taken into account that when making a decision on the application or refusal to apply interim protection, the administrative court should take into account not only the legal interest of the applicant, but also legal and legal interests. positions of other parties and participants in the proceedings. In this case, the risk related to the possibility of maintaining unlawful processing of personal data of a participant in the proceedings argues against the application of temporary protection. For these reasons, the Supreme Administrative Court ruled as in the sentence pursuant to Art. 61 § 3 and 5 in connection with joke. 193 P.p.s.a.