NSA - III OSK 135/23

NSA - III OSK 135/23
Court:	NSA (Poland)
Jurisdiction:	Poland
Relevant Law:	Article 4(1) GDPR
Decided:	02.08.2024
Published:
Parties:
National Case Number/Name:	III OSK 135/23
European Case Law Identifier:
Appeal from:	UODO (Poland) n/a
Appeal to:	Appealed - Overturned WSA Warsaw (Poland) II SA/Wa 4025/21
Original Language(s):	Polish
Original Source:	Centralna Baza Orzeczeń Sądów Administracyjnych (in Polish)
Initial Contributor:	wp

The Supreme Administrative Court held that sending a letter to the registered address of an individual does not violate the rights of another individual residing at the same address. For the purpose of the mailing the address is personal data only regarding the intended recipient, not of other residents.

English Summary

Facts

The Chief of a County (Starosta Powiatowy, the controller) sent a letter addressed to an individual who co-owns land with the county. The letter referred to the fee for perpetual usufruct of the land (użytkowanie wieczyste; i.e. a temporary lease of state's land by a natural or legal person, up to 99 years, in exchange for an annual fee). However, the letter was delivered to another individual (the data subject) residing at the address used by the Chief of County.

The data subject lodged a complaint with the Polish DPA (UODO). The individual argued the land’s co-owner did not reside in the address. The controller explained they used the land’s co-owner's registered address and the data subject's statement was not suffice to invalidate it.

The DPA dismissed the case, emphasising the controller didn’t violated the GDPR by sending the correspondence on the registered address of the land’s co-owner. Additionally, the individual’s right to data protection was not violated, as the authority didn’t process their data, but data of the land’s co-owner.

The individual appealed against the DPA’s decision. The Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie) upheld the DPA’s decision. Consequently, the individual brought the case before the Supreme Administrative Court (Naczelny Sąd Administracyjny).

Holding

The Supreme Administrative Court dismissed the appeal. The court found no evidence of the controller’s misconduct.

Also, the court confirmed the data subject was not affected. The authority acquired the address from the official register. The mere fact that the same address was shared by the data subject and the land’s co-owner didn’t amount to the GDPR violation. The court underlined that, in the case at hand, it was the land’s co-owner data processed, not the data subject's.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.

III OSK 135/23 - Judgment of the Supreme Administrative Court

Date of ruling 2024-08-02

final ruling

Date of receipt    2023-01-20

Court    Supreme Administrative Court

Judges    Małgorzata Pocztarek, Slawomir Pauter, Zbigniew Ślusarczyk /rapporteur chairman/

Symbol with description    647 Data protection issues

Subject headings    Data protection

Related Ref    II SA/Wa 4025/21 - Judgment of the WSA in Warsaw of 2022-09-06

Complained authority    Inspector General for Personal Data Protection

Content of the result   The cassation complaint was dismissed

The referenced regulations    Dz.U. 2024 item 935 article 250 Law of August 30, 2002. Law on proceedings before administrative courts (t. j.)

Sentence

The Supreme Administrative Court, composed of: Chairman: judge NSA Zbigniew Ślusarczyk (spr.) Judges judge NSA Małgorzata Pocztarek judge del. WSA Slawomir Pauter having examined on August 2, 2024 at a closed session in the General Administrative Chamber the cassation complaint of J. K. against the judgment of the Provincial Administrative Court in Warsaw dated September 6, 2022, ref. no. II SA/Wa 4025/21 in a case involving a complaint by J. K. against the decision of the President of the Office for Personal Data Protection dated October 21, 2021, no. ZSPU.440.320.2019.II on the processing of personal data, dismisses the cassation complaint.JustificationThe Provincial Administrative Court in Warsaw, in a judgment dated September 6, 2022, ref. II SA/Wa 4025/21, pursuant to Article 151 of the Act of August 30, 2002. - Law on Proceedings before Administrative Courts (Journal of Laws of 2022, item 329, as amended) hereinafter "p.p.s.a." dismissed J. K.'s complaint against the decision of the President of the Office for Personal Data Protection dated October 21, 2021, No. ZSPU.440.320.2019.II, regarding the processing of personal data.In the justification of the judgment, the Court of First Instance indicated that, by the contested decision, the authority discontinued the proceedings on J. K.'s complaint about irregularities in the processing of his personal data in the scope of his residential address by the Starost of Przemyśl, which consisted in the Starost directing correspondence addressed to K. K. to the complainant's residential address. According to the Court of First Instance, the President of the Office for Personal Data Protection correctly found no violation in the action of the Starost who sent correspondence addressed to K. K. to the complainant's residential address. K. correspondence regarding the update of the fee for perpetual usufruct of land to the address shown in the land and buildings register. This address - despite the fact that, according to the complainant, the person does not live at the above address - was listed as the registered address of K. K. (who, according to the land register, is a co-owner of the property), as well as in the extract from the land register. Therefore, the findings in this regard could not be refuted by the applicant's statement. Thus, the Starosta, by sending official correspondence intended for K. K. to the complainant's address, did not violate the complainant's right to protection of his personal data in the form of his home address. By sending this correspondence, he processed K. K.'s personal data, not the complainant's.In addition, the Court pointed out that the actions of the Starost in question were justified by Article 78(1) of the Act of August 21, 1997 on Real Estate Management (Journal of Laws of 2020, item 1990) hereinafter referred to as "u.g.n.", which in the realities of this case constitutes, described in Article 6(1)(c) of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016. on the protection of natural persons with regard to the processing of personal data and on the free flow of such data and repealing Directive 95/46/EC (Official Journal of the EU L 119 of 04.05.2016, p. 1, as amended), hereinafter referred to as "RODO", a premise legalizing the processing of K. K.'s personal data in the form of her residential address.The applicant filed a cassation complaint, challenging the above judgment in its entirety. He alleged a violation of substantive law (item 1), i.e., Article 151 p.p.s.a. in conjunction with Article 78(1) of the Real Estate Management Act, by misinterpreting it to assume that the aforementioned provision of the Real Estate Management Act can constitute an independent premise for the processing of personal data.In addition, the appellant alleged a violation of the rules of procedure (item 2), which failure could have had a significant impact on the outcome of the case, i.e. Article 151 of the Code of Administrative Procedure, in conjunction with Article 7, Article 77 § 1 and Article 107 § 1 and 3 of the Code of Administrative Procedure, by wrongly assuming that the administrative body had collected the necessary evidence to issue a decision and had taken the necessary steps to establish the facts of the case and clarified all the relevant circumstances of the case, which led to the unjustified dismissal of the complaint.Based on the allegations formulated in this way, the appellant requested that the contested decision be reversed in its entirety and the contested decision be annulled, or, alternatively, that the contested decision be reversed in its entirety and the case be referred back to the Provincial Administrative Court in Warsaw for reconsideration. In addition, the appellant's ex officio attorney requested that the appellant be awarded the costs of unpaid ex officio legal aid and reimbursement of expenses.In the grounds for the cassation appeal, he argued that the Court of First Instance erred in assuming that Article 78(1) of the A.G.N. constituted an independent basis for processing the applicant's personal data. According to the appellant, this provision should be linked to other relevant provisions obligating the provision of certain personal data with an indication of the purpose of such processing. The aforementioned provision is a substantive provision authorizing the authority to update the annual fee for perpetual usufruct of land, and not justifying the processing of the applicant's personal data.In response to the cassation complaint, the President of the Office for Personal Data Protection filed a motion to dismiss the cassation complaint. In justification, he pointed out that the legal basis for the processing of personal data by the head of the district was Article 78 (1) of the Act, in conjunction with other provisions of law. Regarding the allegation of violation of procedural regulations, according to the authority, the administrative decision was issued on the basis of sufficient evidence, obtained as a result of administrative proceedings conducted in accordance with the rules set forth in the Code of Administrative Procedure.

The Supreme Administrative Court has considered the following:

Pursuant to Article 183 § 1 of the Act of August 30, 2002. - Law on Proceedings before Administrative Courts (i.e., Journal of Laws of 2024, item 935), hereinafter referred to as p.p.s.a., the Supreme Administrative Court considers the case within the limits of the cassation complaint, taking into account ex officio only the invalidity of the proceedings. In the case under review, none of the circumstances resulting in the invalidity of the proceedings referred to in Article 183 § 2 of p.p.s.a. and none of the prerequisites referred to in Article 189 of p.p.s.a., which the Supreme Administrative Court considers ex officio when reviewing the judgment appealed by the cassation complaint, occur. Under these circumstances, only the allegations raised in the cassation complaint in support of the cassation grounds cited were subject to examination in the case.The cassation complaint is subject to dismissal as lacking legitimate grounds.The cassation complaint formulates both a charge of violation of substantive law and a charge of violation of procedural regulations. In this state of affairs, the Supreme Administrative Court will first address the allegation of violation of procedural regulations.As part of the allegation of violation of Article 151 of the Code of Administrative Procedure, in conjunction with Article 7, Article 77 § 1 and Article 107 § 1 and 3 of the Code of Administrative Procedure, the cassation complainant indicates that the authority failed to gather the necessary evidence for the decision and take the necessary steps to establish the facts of the case. However, it is the duty of the cassation applicant to cite the reasons for the cassation grounds and explain why the alleged failure could have had a significant impact on the outcome of the case. It follows from the case law of the Supreme Administrative Court that "the cassation applicant is obliged to specify already in the content of the cassation grounds in detail the manner and form of the violation of substantive or formal-procedural law in the plane of assertions concretized against the background of the individual elements of the factual and legal state of the case, and not only in the abstract layer referring in general to the control patterns. This requirement is particularly important with regard to the grounds under Article 174(2) p.p.s.a. to the extent that the cassation complaint alleges a violation of the provisions of administrative proceedings (in fact, by an erroneous assessment of the legality of their interpretation or application) or administrative court proceedings. In such a case, it is not sufficient to generally indicate within the framework of the cassation ground (Article 176.1.2 p.p.s.a.) a violation of selected provisions of the Code of Administrative Procedure (e.g., Article 7, Article 77.1 or Article 80 of the Code of Administrative Procedure) without linking - in the description of the ground itself - this violation to specific factual or legal circumstances of the state of the case that were omitted or erroneously assessed by the Court of First Instance" (NSA judgment of January 30, 2024, II GSK 1255/23, LEX no. 3689009). In the present case, the applicant in cassation failed to meet the above requirements, as the cassation complaint does not indicate what specific evidence was omitted by the authority and what circumstances should have been established by the President of the Office of Competition and Consumer Protection. General indications in this regard cannot be considered sufficiente, unspecified and unrelated to the facts of the case.Regardless, in the opinion of the NSA in the panel, the court of first instance did not violate Article 151 p.p.s.a. in conjunction with Article 7, Article 77 § 1 and Article 107 § 1 and 3 of the Code of Administrative Procedure. It was correctly pointed out in the appealed judgment that the authority correctly established the facts adopted as the basis for the decision, relying on data derived from the land register, the land registry and the PESEL General Electronic Population Register System, and that it was correct for the Starost to address correspondence addressed to K. K. to the applicant's residential address. First and foremost, the key finding in this case is the finding in the appealed judgment that the residential address of K. K. - although it is the same as the complainant's residential address - is, as far as she is concerned, her personal data. It should be recalled that the scope of the administrative court case is determined by the content of the challenged act or action - here, the decision of the President of the Office for Personal Data Protection dated October 21, 2021, No. ZSPU.440.320.2019.II on the processing of theia of personal data. The decision stated that the complainant had complained to the authority about "the processing of his personal data in terms of his residential address by the Przemyśl Starost, which consisted in the Starost directing correspondence addressed to K. K. to the complainant's residential address". Thus, the scope of facts and evidence necessary to resolve the case was determined by the subject matter of the proceedings, and indirectly by the complainant, questioning the propriety of the Starost's sending correspondence addressed to a third party. The authority, in determining that the action of the Starosta in this regard was correct, was not entitled to go beyond the boundaries of the administrative case and determine other (unspecified in the cassation complaint) facts of the case.Turning to the allegation of violation of substantive law, there can be no violation of the applicant's personal data protection based on the fact that the Starost sent correspondence addressed to another person to his address, when this address was also the residential address of another person - the addressee of the correspondence. As indicated above, the residential address of K. K. is her personal data, not the personal data of the applicant. Thus, a possible finding of a violation of data protection regulations could arise from a complaint by the above-mentioned person, not the complainant. Although the complainant's address is the same as the address of the above-mentioned entity, the addressing of correspondence by an administrative body (here: the Starost) to the complainant's address, but addressed to another person, does not automatically constitute a violation of the protection of the complainant's personal data. According to Article 4(1) of the RODO, " means any information about an identified or identifiable natural person ("data subject"); possible do identify a natural person is a person who can be directly or indirectly identified, in particular on the basis of an identifier such as a name, an identification number, location data, an online identifier or one or more specific factors that determine the physical, physiological, genetic, mental, economic, cultural or social identity of the natural person." Data such as a residential address must be analyzed in connection with a specific person, in the present case the address was linked to the person K. K., and not with the person of the complainant. Admittedly, the processing of personal data is understood broadly, as any operation or set of operations performed on personal data (Article 4(2) of the RODO, nevertheless, in order for the President of the DPA to establish a violation of the principles of personal data processing, the processing must relate to the complainant.In conclusion, in the present case there can only be a coincidence of addresses of the complainant and the third party to whom the public administration body directed official correspondence. Hypothetically, even incorrectly directing correspondence to a third party by the Starost to the complainant's address does not amount to the processing of the complainant's personal data. In order to speak of the processing of the complainant's personal data, data such as the address would have to be linked to other data allowing the identification of the individual, including his name.Regardless, as aptly noted by the authority and the Court of First Instance, Article 6(1)(c) of the RODO constitutes the premise legalizing the processing of the address in correspondence addressed to K., as questioned by the applicant. K., as this action was necessary to fulfill a legal obligation incumbent on the administrator (the Starost). This obligation resulted from Article 78(1) of the Real Estate Management Law, according to which the update of the annual fee is carried out by the competent authority, and the provisions of the Code of Administrative Procedure apply to the service of the notice. According to Article 6(1)(c) of the RODO, processing is lawful only if - and to the extent that - at least one of the following conditions is met (...) processing is necessary for the fulfillment of a legal obligation incumbent on the controller. Since in the present case the Starosta was obliged to update the annual fee, at the same time, contrary to the allegation of the cashier's complaintcation was authorized to process the personal data necessary to make this update. "Legal obligation" from Article 6(1)(c) of the RODO is to be understood broadly, at the same time it is not required that this obligation be accompanied by a specific authorization for the authority to process the personal data of the person to whom the above obligation applies. This is indirectly confirmed by the content of Article 2a of the Code of Administrative Procedure, to which Article 78(1) of the A.G.N. refers and which indicates the implementation of certain duties of the authority related to the processing of personal data in administrative proceedings. The above findings prejudged the unfoundedness of the allegation of violation of Article 151 of the Code of Administrative Procedure in conjunction with Article 78(1) of the Real Estate Law.In view of the above arguments, the Supreme Administrative Court found that the cassation complaint had no justified grounds, and therefore dismissed it under Article 184 p.p.s.a.The Supreme Administrative Court did not rule on the reimbursement of the costs of unpaid legal assistance provided to the cassation applicant ex officio in the framework of the right of assistance granted to him, since the remuneration to the applicant's attorney for the legal assistance provided, due from the State Treasury under Article 250 p.p.s.a., is awarded by the provincial administrative court in the proceedings set forth in Articles 258-261 p.p.s.a. There were also no grounds for ruling on the reimbursement of expenses incurred by the attorney for legal assistance provided to the party ex officio, since Articles 203 - 204 and Article 205 § 2 p.p.s.a. entitle the cassation court to rule on the reimbursement of expenses incurred by the attorney only to the party.