NSA - III OSK 135/23: Difference between revisions

Revision as of 11:09, 23 September 2024

NSA - III OSK 135/23

Court:	NSA (Poland)
Jurisdiction:	Poland
Relevant Law:	Article 4(1) GDPR
Decided:	02.08.2024
Published:
Parties:
National Case Number/Name:	III OSK 135/23
European Case Law Identifier:
Appeal from:	UODO (Poland) n/a
Appeal to:	Appealed - Overturned WSA Warsaw (Poland) II SA/Wa 4025/21
Original Language(s):	Polish
Original Source:	Centralna Baza Orzeczeń Sądów Administracyjnych (in Polish)
Initial Contributor:	wp

The Supreme Administrative Court rejected the cassation appeals as unfounded. The delivery of a letter addressed to land’s co-owner on their registered address did not violate the GDPR.

English Summary

Facts

The Chief of a County (Starosta Powiatowy, the controller) sent a letter addressed to an individual who co-owns land with the county. The letter referred to the fee for usufruct (the county's right to receive some of the profits of the land). However, the letter was delivered to another individual (the data subject) residing at the address used by the Chief of County.

The data subject lodged a complaint with the Polish DPA (UODO). The individual argued the land’s co-owner did not reside in the address. The controller explained they used the land’s co-owner's registered address and the data subject's statement was not suffice to invalidate it.

The DPA dismissed the case, emphasising the controller didn’t violated the GDPR by sending the correspondence on the registered address of the land’s co-owner. Additionally, the individual’s right to data protection was not violated, as the authority didn’t process their data, but data of the land’s co-owner.

The individual appealed against the DPA’s decision. The Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie) upheld the DPA’s decision. Consequently, the individual brought the case before the Supreme Administrative Court (Naczelny Sąd Administracyjny).

Holding

The Supreme Administrative Court dismissed the appeal. The court found no evidence of the controller’s misconduct.

Also, the court confirmed the data subject was not affected. The authority acquired the address from the official register. The mere fact that the same address was shared by the data subject and the land’s co-owner didn’t amount to the GDPR violation. The court underlined that, in the case at hand, it was the land’s co-owner data processed, not the data subject's.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.

@@ Line 65: / Line 65: @@
 === Facts ===
-A Chief of a County (Starosta Powiatowy, an authority) sent letter deliver to an individual. The letter referred to the fee for usufruct of the land and was addressed to one of the land’s co-owner.
+The Chief of a County (Starosta Powiatowy, the controller) sent a letter addressed to an individual who co-owns land with the county. The letter referred to the fee for usufruct (the county's right to receive some of the profits of the land). However, the letter was delivered to another individual (the data subject) residing at the address used by the Chief of County.
-The individual lodged a complaint with the Polish DPA (UODO). The individual argued the land’s co-owner did not reside in the address. The authority explained they used the land’s co-owner registered address and the individual statement was not suffice to invalidate it.
+The data subject lodged a complaint with the Polish DPA (UODO). The individual argued the land’s co-owner did not reside in the address. The controller explained they used the land’s co-owner's registered address and the data subject's statement was not suffice to invalidate it.
-The DPA dismissed the case, emphasising the authority didn’t violated the GDPR by sending the correspondence on the registered address the land’s co-owner. Additionally, the individual’s right to data protection was not violated, as the authority didn’t process their data, but data of the land’s co-owner.
+The DPA dismissed the case, emphasising the controller didn’t violated the GDPR by sending the correspondence on the registered address of the land’s co-owner. Additionally, the individual’s right to data protection was not violated, as the authority didn’t process their data, but data of the land’s co-owner.
 The individual appealed against the DPA’s decision. The Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie) upheld the DPA’s decision. Consequently, the individual brought the case before the Supreme Administrative Court (Naczelny Sąd Administracyjny).
 === Holding ===
-The court dismissed the cassation appeal.  The court found no evidence of the authority’s misconduct.
+The Supreme Administrative Court dismissed the appeal.  The court found no evidence of the controller’s misconduct.
-Also, the court confirmed the individual was not affected. The authority acquired the address from the official register. The mere fact that the same address was shared by the individual and the land’s co-owner didn’t amount to the GDPR violation. The court underlined that, in the case at hand, it was the land’s co-owner data processed, not the individual.
+Also, the court confirmed the data subject was not affected. The authority acquired the address from the official register. The mere fact that the same address was shared by the data subject and the land’s co-owner didn’t amount to the GDPR violation. The court underlined that, in the case at hand, it was the land’s co-owner data processed, not the data subject's.
 == Comment ==