NSA - III OSK 769/23

NSA - III OSK 769/23
Court:	NSA (Poland)
Jurisdiction:	Poland
Relevant Law:	Article 6(1)(f) GDPR Article 9(2)(d) GDPR Article 9(2)(f) GDPR Article 17(1) GDPR
Decided:	03.09.2024
Published:
Parties:
National Case Number/Name:	III OSK 769/23
European Case Law Identifier:
Appeal from:	WSA Warsaw (Poland) II SA/Wa 3668/21
Appeal to:	Not appealed
Original Language(s):	Polish
Original Source:	Centralna Baza Orzeczeń Sądów Administracyjnych (in Polish)
Initial Contributor:	bee22

The Supreme Administrative Court held that processing of former member’s personal data by a religious organisation may be lawful under Article 6(1)(f) GDPR and Article 9(2)(d) GDPR and does not have to be based on consent.

English Summary

Facts

The data subject is a former member of Jehovah's Witnesses (the controller). She left the organisation in 2020. The data that the controller has collected during the time of her membership was retained by the controller after her exit. The data subject decided to lodge a complaint against the controller claiming that, 1) the processing does not have a lawful basis under the GDPR and, 2) the controller did not allow for her exercise of right to be forgotten under Article 17 GDPR as they did not erase her data from their data base and did not return physical documents containing her personal data.

The complaint was rejected by the DPA. The case was later lodged with the Administrative Court and was decided in favour of the controller. The data subject lodged an appeal with the Supreme Administrative Court.

Holding

The Polish Supreme Administrative court did not revisit all the facts of the case, but only specific errors raised by the data subject. The cassation appeal was rejected in its entirety due to the fact, that, 1) the data subject did not specify which specific subsection of Article 9 GDPR is supposed to be violated and therefore is the legal basis of the appeal and, 2) the factual nature of the appeal was incorrect, as the data subject claimed Article 9 GDPR cannot be fulfilled, as she never consented for processing. The Supreme Administrative Court has expressed or affirmed the following:

1. Processing of historical data of a former member of a religious organisation may be lawful under Article 6(1)(f) GDPR and does not have to be based on consent Article 6(1)(a) GDPR.
2. As the data is sensitive within the meaning of Article 9 GDPR, such processing of historical data of a former member will be lawful under Article 9(2)(d) GDPR (the internal processing by certain organisations), subject to appropriate technical safeguards.
3. Data regarding former members which relate to ongoing court proceedings should be processed on the basis of Article 9(2)(f) GDPR (exercise or defence of legal claims), however as the data subject did not raise this point in her appeal, the court could not examine this further.
4. Data of former members which is still necessary for the purpose of collection may be retained. In the case of the controller, data of former members are indispensable for realisation of statutory purposes.
5. The GDPR, specifically Article 17, does not bestow rights upon any enforcement organs, be it a court or a DPA, to demand a return of documents or copies of documents.

Comment

Share your comments here!

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.

By judgment of 27 October 2022, file reference II SA/Wa 3668/21, the Voivodship Administrative Court in Warsaw dismissed the complaint of D. K. (hereinafter: "the complainant") against the decision of the President of the Personal Data Protection Office (hereinafter: "the authority") of 24 August 2021 regarding the processing of personal data.

The above judgment was issued in the following factual and legal circumstances of the case.

By letter of 30 August 2019, pursuant to Article 17 sec. 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, the General Data Protection Regulation (hereinafter referred to as the "Regulation" or "GDPR"): the complainant requested the Personal Data Protection Office to oblige the management of the Association [...] (hereinafter referred to as the Association), to return all documents processed without the necessary written and any consent of the complainant, in the possession of the Association, which would mean the deletion of her personal data from the resources of the Branch Office [...] in P. and, pursuant to Art. 38 of Directive 95/46/EC, to conduct an inspection on the protection of personal data by the body, in order to determine the compliance of their processing according to the Regulation, and to delete the Complainant's personal data pursuant to the Regulation in connection with the processing of personal data from the resources of the Association. The complainant referred to Art. Article 17 paragraph 1 of the Regulation, which states that the data subject has the right to request their immediate deletion and without undue delay. The complainant argued that 1.5 years had passed since the request of 8 January 2018, and the Committee had not responded to her request by the date of the letter. After conducting administrative proceedings on the above-mentioned complaint, the Authority, concerning irregularities in the processing of the complainant's personal data by the Association, consisting in failure to comply with the request to delete her personal data and return all documents in the possession of the Association, on the basis of Article 104 paragraph 1 of the Act of 14 June 1960 - the Code of Administrative Procedure (Journal of Laws of 2021, item 735, hereinafter referred to as "the Code of Administrative Procedure") in connection with Article 7 paragraph 1 and 2 of the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2019, item 1781) in conjunction with Art. 6 sec. 1 letter f and Art. 9 sec. 2 letter d of the Regulation issued a decision refusing the application on 24 August 2021.

In the justification of the decision in question, the authority stated that the personal data of the Applicant are processed in order to achieve the statutory objectives of the Association, as well as to establish, pursue or defend legal claims under Art. 6 sec. 1 letter f and Art. 9 sec. 2 letters d and f of the Regulation.
In addition, the Union currently processes the complainant's personal data
to a limited extent, i.e. basic personal data identifying the complainant, data on her membership status, basic contact data and data on the period of performing the function of a permanent pioneer, completed training and information
on the proceedings pending in the past before the Inspector General for Personal Data Protection, which were conducted as a result of a complaint filed by the complainant against the Union. The Union also has information on civil proceedings initiated by the complainant in the past against one of the elders of the congregation [...], in which proceedings she called as a witness a member of the Union's Branch Committee and on attempts by the complainant to initiate criminal proceedings against several elders of the congregation. The Union stores this limited data on membership in the congregation in order to prevent rebaptisms that are not in accordance
with basic religious beliefs [...] and in case
in the future the complainant requests the restoration of the Union's membership status. The storage of the above-mentioned records regarding the historical status as a preacher and the biblical basis for the termination of membership in the congregation is necessary for the implementation of the legitimate religious purposes of the Association (explanation of the Association of February 7, 2020). It was emphasized that the Association does not apply detailed principles of the protection of natural persons in connection with the processing of personal data within the meaning of Article 91 paragraph 1 of the Regulation. A separate body referred to in Article 91 paragraph 2 of the Regulation has not been established.

The authority explained that, in accordance with the findings made, the complainant had withdrawn from the Association and therefore had the status of a former member of the Association.

In light of the presented circumstances of the case and the cited legal provisions, the authority found that the processing of the complainant's personal data by the Association as a former member of the Association is based on Article 6 paragraph 1 letter f of the Regulation - in the scope of so-called ordinary data and Article 9 paragraph 2 letter d) of the Regulation - in the scope of special category data. In connection with the complainant's request to return all documents in the possession of the Association, the authority emphasized that no provision of the Regulation or the Personal Data Protection Act 2018 does not authorize the President of the UODO to issue orders to provide documents or copies of documents. Therefore, the President of the UODO cannot satisfy the above-mentioned request of the complainant and order the return of documents in the possession of the Association.

The authority also referred to the complainant's application to conduct an inspection of the personal data processing processes by the Association and indicated that it results from the content of
Article 78 paragraph 1 of the UODO that the President of the UODO conducts an inspection of compliance with the provisions on the protection of personal data. The initiation of the inspection proceedings falls within the competence of the President of the UODO and is not carried out at the request of a party in administrative proceedings initiated by her application.

On September 16, 2021, the complainant appealed against the decision of the PUODO of August 24, 2021 to the Provincial Administrative Court in Warsaw. She requested an inspection to determine whether there was inaction, excessive length of the case, invalidity of the decision, and a gross violation of the law in this case.
By letter dated 8 October 2021, the complainant filed another complaint with the Provincial Administrative Court against the decision of the President of the Personal Data Protection Office dated 24 August 2021. 
In response to the complaint, the authority requested its dismissal due to the unfounded allegations contained therein. 
In the judgment described at the beginning, the Provincial Administrative Court dismissed the complaint. The court shared the authority's view that the processing of the complainant's personal data by the Association, as a former member of the Association, is based on the so-called ordinary data in art. 6 sec. 1 letter f of the GDPR, and in the scope of special category data in art. 9 sec. 2 letter d) of the GDPR, and stated that the administrative proceedings did not demonstrate that the complainant's personal data were stored without appropriate safeguards. 
Referring to the issue of the application contained in the complaint to the PUODO for the body to issue an order to the Union to provide the complainant with documents or copies of documents, the Court found that the body's position in this respect is in line with applicable law, because none of the provisions of the regulation or the Personal Data Protection Act of 2018 authorizes the President of the UODO to issue orders to provide documents or copies of documents. 
The above judgment was appealed in its entirety, accusing it of violating substantive law, i.e. art. 9 of the regulation through its incorrect application consisting in assuming that in the established factual circumstances, the legal norm adopted as the basis for the decision applies, while the factual circumstances of the case do not correspond to this hypothesis, and therefore are not adequate to the general and abstract pattern of the factual arrangement designated by it, which activates the application of this norm. 
Based on the above objection, the complainant requested that the judgment be set aside in its entirety; to award costs, including the costs of legal representation, and also declared that she waived the hearing. 
The Supreme Administrative Court considered the following:

In view of the cassation complainant's statement of waiver of a hearing, the case was considered in camera - art. 182 § 2 p.p.s.a.

In accordance with art. 183 § 1 p.p.s.a., the Supreme Administrative Court shall consider the case within the limits of the cassation appeal, taking into consideration ex officio only the invalidity of the proceedings. In the case under consideration, none of the circumstances resulting in the invalidity of the proceedings, as referred to in art. 183 § 2 p.p.s.a., and none of the premises referred to in art. 189 p.p.s.a., which the Supreme Administrative Court considers ex officio when reviewing the judgment contested in the cassation appeal, occur. Therefore, the Supreme Administrative Court moved on to examine the cassation objections.

The cassation appeal is unfounded and as such is subject to dismissal. A cassation appeal is a formalized means of appeal that defines the limits of the instance control exercised by the Supreme Administrative Court. The entity filing a cassation appeal is responsible for defining its limits by correctly formulating the grounds for appeal – the objections. The Supreme Administrative Court reviews the judgment of the court of first instance appealed in the cassation appeal from the perspective of the violations of law raised therein. The possibility of conducting this review depends on the identifiability of these violations. In other words, the Supreme Administrative Court may review the judgment of the court of first instance if the cassation appeal cites specific provisions of law which, in the opinion of the person filing the appeal, have been violated. In the case law of the Supreme Administrative Court, the assessment of the structural defect of the objection exposing the violation of a provision of law has been expressed many times by referring to the editorial unit of the legal act – the article (article), which is divided into subsequent, subordinate normative statements constituting independent directives of the procedure. The requirement of an effectively filed cassation appeal is met when it indicates a specific provision as violated,
with the number of a specific editorial unit provided. Only such a precise objection allows the limits of the appeal to be established - see: judgments of the Supreme Administrative Court of 29 January 2008, reference number I OSK 2034/06 and of 10 May 2011, reference number II OSK 2520/10.
In the cassation appeal filed, only one objection was raised: the incorrect application of Article 9 of the GDPR. Article 9 of the GDPR is divided into four paragraphs,
and paragraph 2 is divided into letters, from "a" to "j". Each of the separate editorial units constitutes a substrate of an independent directive of conduct - a legal norm. It is not the role of the Supreme Administrative Court to seek the intentions of the cassation appealing party and identify the proper normative basis for the cassation objection.
In the justification of the cassation appeal, it was argued that Article 9 of the GDPR could not apply in the case, because the appellant did not consent to the processing of her personal data by the Association. The cassation appealing party does not notice that the Provincial Administrative Court indicated as the basis for processing her personal data: in the scope of so-called ordinary data in Article 6 paragraph 1 letter f of the GDPR, and in the scope of special category data
in Article 9 paragraph 2 letter d) of the GDPR. Processing personal data on these grounds does not require the consent of the person to whom the data relates.
The complainant in the cassation appeal points out that it is not necessary to process her personal data in the scope of: contact details, data regarding the period of performing the function of permanent pioneer, completed training and information about the proceedings pending in the past before the Inspector General for Personal Data Protection, which were conducted as a result of a complaint filed by the complainant against the Association. In the complainant's opinion, the data in question are of no significance for the achievement of the Association's objectives or securing possible court proceedings. It should be noted that the processing of the complainant's personal data by the Association for the purposes of possible court proceedings should be considered in the context of the application of art. 6 sec. 1 letter f of the GDPR - see the judgment of the Supreme Administrative Court of 20 February 2024, III OSK 2700/22. The allegation of violation of this provision was not raised in the cassation appeal, which deprives the Supreme Administrative Court of the possibility of conducting a review of the judgment of the Provincial Administrative Court in this respect. It is also impossible to address the allegation of the justification for the processing of the complainant's personal data in the context of the Association's purpose, because the complainant does not state what the flawed findings and assessments made in this respect by the Provincial Administrative Court were. The complainant also does not state how, in her opinion, the phrase "in connection with its purposes" used in Article 9 paragraph 2 letter d of the GDPR should be understood. Regardless of the above, this issue could be considered within the framework of the allegation of incorrect interpretation of Article 9 paragraph 2 letter d of the GDPR, which, however, was not raised in the cassation appeal. For the reasons given, the Supreme Administrative Court, acting under Article 184 of the p.p.s.a., dismissed the cassation appeal.