NSA (Poland) - III OSK 4727/21
From GDPRhub
| NSA (Poland) - III OSK 4727/21 | |
|---|---|
 | |
| Court: | NSA (Poland) |
| Jurisdiction: | Poland |
| Relevant Law: | Article 6(1)(f) GDPR Article 17(3)(e) GDPR |
| Decided: | 23.10.2024 |
| Published: | |
| Parties: | |
| National Case Number/Name: | III OSK 4727/21 |
| European Case Law Identifier: | |
| Appeal from: | WSA Warsaw (Poland) II SA/Wa 781/20 |
| Appeal to: | Unknown |
| Original Language(s): | Polish |
| Original Source: | Centralna Baza Orzeczeń Sądów Administracyjnych (in Polish) |
| Initial Contributor: | w.p. |
The Supreme Administrative Court clarified a controller legitimate interest may cover defence of legal claims, even if an employment relationship ceased under mutual consent of the parties.
English Summary
Facts
A former employee of a health care institution filed a complaint with the Polish DPA (UODO). The employee (a data subject) claimed the health care institution (a controller) unlawfully processed their data stored on their business computer hard drive. For the data subject, there was no legal basis to process their data after the employment relationship ceased. Consequently, the data subject asked for deletion of their data.
The DPA ordered deletion of personal data by the controller. According to the DPA, the controller didn’t have legitimate interest under Article 6(1)(f) GDPR to process the data. Although the controller argued the data were necessary for defence of legal claims, the claims were of hypothetical nature. Thus, the controller processed the data in advance.
The controller brought an appeal with the Voivodeship Administrative Court of Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The appeal was dismissed. The court found no evidence that processing of the data at stake was necessary for the purpose of controller’s legitimate interest. The court emphasised that purely theoretical, future claims cannot justify data processing once the employment relation came to an end under conciliatory agreement (mutual consent of the parties . Hence, the DPA’s decision was upheld.
The controller lodged a cassation appeal before the Supreme Administrative Court (Naczelny Sąd Administracyjny – NSA).
Holding
The Supreme Administrative Court upheld the cassation appeal.
The court of first instance failed to hear the case properly. The appeal was not thoroughly assessed and not all the controller’s statements against the DPA decisions were answered. In particular, the court of first instance didn’t identify the category of data processed by the controller, nor the data stored on the hard drive. It remained unknown whether the hard drive contained also data of other individuals. Moreover, the court of first instance didn’t explain in detail why the controller was not allowed to process these data for defence of legal claims. Furthermore, the court of first instance based its reasoning on inaccurate assumption that conciliatory agreement excluded any potential claims of the data subject, whilst it was applicable only to the employment relationship.
Therefore, the Supreme Administrative Court decided to refer the case back to the court of first instance.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.
Date of judgment 2024-10-23 final judgment Date of receipt 2021-04-28 Court Supreme Administrative Court Judges Maciej Kobak /rapporteur/ Olga Żurawska - Matusiak Zbigniew Ślusarczyk /chairman/ Symbol with description 647 Cases related to personal data protection Thematic entries Personal data protection Related references II SA/Wa 781/20 - Judgment of the Provincial Administrative Court in Warsaw of 2020-11-16 Accused body Inspector General for Personal Data Protection Content of the result The contested judgment was set aside and the case was referred for reconsideration by the Provincial Administrative Court Referenced provisions Journal of Laws 1997 No. 78 item 483 art. 45 par. 1 Constitution of the Republic of Poland of 2 April 1997 adopted by the National Assembly on 2 April 1997, adopted by the Nation in a constitutional referendum on 25 May 1997, signed by the President of the Republic of Poland on 16 July 1997. Journal of Laws 2023 item 1634 art. 141 par. 4 Act of 30 August 2002 - Code of Administrative Court Procedure - consolidated text Journal of Laws 2018 item 1000 art. 4 items 1-3, art. 6 par. 1, art. 9, art. 17 par. 1, art. 57 par. 1 letter f), art. 58 par. 1, art. 17 sec. 3 letter e) Act of 10 May 2018 on the Protection of Personal Data Journal of Laws 2023 item 1634 art. 185 par. 1 Act of 30 August 2002 - The Code of Administrative Court Procedure - consolidated text Opinion The Supreme Administrative Court, composed of: Presiding Judge: Zbigniew Ślusarczyk, Judge of the Supreme Administrative Court Judges Olga Żurawska–Matusiak, Judge of the Provincial Administrative Court Maciej Kobak (rapporteur) Clerk of the Court Senior Assistant to the Judge Wojciech Wiktorowski after considering on 23 October 2024 at the hearing in the General Administrative Chamber the cassation appeal of the Specialist Healthcare Team [...] against the judgment of the Provincial Administrative Court in Warsaw of 16 November 2020, reference number Act II SA/Wa 781/20 in the case of the complaint of the Specialist Healthcare Team [...] against the decision of the President of the Personal Data Protection Office of 6 February 2020, No. ZSZZS.440.279.2018.ZS.AO.65627,65628 regarding the order to delete personal data I. sets aside the contested judgment and refers the case for reconsideration to the Provincial Administrative Court in Warsaw, II. awards the Specialist Healthcare Team [...] the amount of PLN 560 (five hundred sixty) from the President of the Personal Data Protection Office as reimbursement of the costs of cassation proceedings. Justification By judgment of 16 November 2020, ref. no. Act II SA/Wa 781/20 The Voivodship Administrative Court in Warsaw dismissed the complaint of the Specialist Psychiatric Health Care Team [...] (hereinafter: "the complainant") against the decision of the President of the Personal Data Protection Office (hereinafter: "the authority") of 6 February 2020, No. ZSZZS.440.279.2018.65627,65628 regarding the order to delete personal data. The above judgment was issued in the following factual and legal circumstances of the case. In a letter dated August 21, 2019, J. A. (hereinafter referred to as the "applicant") requested the authority to order the director of SP ZOZ [...] to delete from the hard drive of the company computer all files created by the applicant during his employment, from the day the computer was entrusted to him for use until the day his employment ended on November 22, 2016. The President of the Personal Data Protection Office, acting under Article 104 § 1 of the Act of June 14, 1960 - the Code of Administrative Procedure (Journal of Laws of 2018, item 2096, hereinafter referred to as the "K.p.a.") and Article 6 paragraph 1 and Article 9 paragraph 2 in conjunction with Article 5 paragraph 1 letter c) and Article 58 paragraph 2 letter b) Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46AA/E (General Data Protection Regulation) (OJ L. 2016.119.1 and OJ L. 2018.127.2, hereinafter referred to as "GDPR") on 6 February 2020 ordered the complainant to delete the applicant's personal data within 30 days from the date of delivery of the decision. In the letter of 10 March 2020, the above decision was appealed in its entirety. In the justification of the complaint, it was argued that the products created on the employee's work computer are the property of the employer, especially since they were created during the applicant's working hours. According to the complainant, it is also impossible to ignore the fact that storing any private files on a company computer by an employee could constitute an action to the detriment of the employer. In the judgment described in the introduction, the Regional Administrative Court in Warsaw dismissed the complaint. According to the Court of First Instance, the body rightly found that the processing of personal data by the complainant is not currently necessary for the fulfilment of legally justified purposes, and in particular the purpose of the right to defend against any claims or allegations concerning the processing of his personal data, especially in a situation where his employment contract has been terminated. The Regional Administrative Court emphasised that the processing of data should be necessary for the fulfilment of legally justified purposes, so it is inadmissible to process personal data "for now" with the assumption that they may be useful in the future and with reference to the provisions on the limitation of civil law claims. Recognising the complainant's argument as justified could lead to absurd conclusions that the administrator is entitled to longer process the data of a former employee with whom he is not bound by an employment contract. Referring in this case to evidentiary purposes for the purposes of potential civil, criminal or administrative proceedings that the former employee could potentially bring against the former employer on the basis of the non-existent obligation relationship between the parties did not find any logical or legal justification in the opinion of the adjudicating panel. The court shared the view of the authority that in this case there was no premises legalizing the processing of the applicant's personal data, specified in the provisions of the GDPR (Article 6, paragraph 1 and Article 9, paragraph 2). The appellant filed a cassation appeal against the above judgment, challenging it in its entirety and accusing it of violating: I. provisions of procedural law, i.e.: 1. Article 106 § 3 of the Act of 30 August 2002 - the Code of Administrative Court Procedure (Journal of Laws of 2019, item 2325, hereinafter "p.p.s.a.") in connection with with art. 106 § 5 p.p.s.a. in connection with art. 227 of the Act of 17 November 1964 - the Code of Civil Procedure (Journal of Laws of 2020, item 1575, hereinafter referred to as: "kpc") by failing to take the evidence requested by the complainant from documents in the procedural letter of 25 August 2020, which was necessary to clarify significant doubts in the case and did not cause excessive prolongation of the proceedings, as a result of which the ruling was issued with incorrectly and incompletely established factual circumstances, i.e. omitting that the complainant has a legal basis for storing and processing data (including personal data) located on the hard drive, and this is art. 22 sec. 1 item 3 in connection with art. 5 sec. 1 point 2 of the Act of 14 July 1983 on the national archival resources and archives (Journal of Laws of 2020, item 164, hereinafter referred to as the "Archives Act") in connection with art. 6 sec. 1 letter c) or letter e) of the GDPR in connection with the internal order of the Director of the Specialist Psychiatric Health Care Team [...] no. 72/06 of 20.12.2006. At the same time, the appellant in cassation indicated that the judgment was issued at a closed session at which no minutes were drawn up, as a result of which it was not possible to submit an objection to the minutes pursuant to art. 105 of the p.p.s.a. 2. art. 141 §4 of the p.p.s.a. by failing to include in the justification of the judgment: a) the legal basis for the judgment, because citing the content of the GDPR provisions while not subsuming the content of the norms to the factual circumstances in the case, and in particular the legal situation of the complainant, who also processes these data based on the obligation arising from the Act (archiving obligation), does not constitute providing a legal basis for the judgment; b) an unambiguous indication of the factual circumstances that the Court of First Instance considered established and adopting the position of the administrative body as its own, as evidenced by the literal citation of the content of the letters of the administrative body without a detailed explanation of the significance of the allegations raised by the complainant at the stage of the proceedings before the Provincial Administrative Court, and which allegations were not verified by the administrative body at the stage of the administrative proceedings; c) referring to all the indicated allegations of the complaint submitted to the Provincial Administrative Court; as a result of which there was a violation consisting in the failure to include in the justification of the contested judgment all the essential premises which were followed by the Court issuing the judgment, i.e. the lack of an exhaustive explanation of the factual basis of the judgment and an explanation of the legal basis of the decision, which due to the factual and legal lack of justification of the contested judgment makes its appellate review impossible and at the same time constitutes a violation of the right to a court, referred to in art. 45 sec. 1 of the Constitution of the Republic of Poland; 3. art. 145 §1 item 1 letter c p.p.s.a. in connection with art. 151 p.p.s.a. in connection with: a) art. 6 of the Act of 14 June 1960 k.p.a. in connection with art. 4 of the European Code of Good Administrative Behaviour (OJ EU.C.2011.285.3) by failing to annul a decision that: - imposes on the complainant the obligation to perform actions that expose the complainant to criminal, civil and administrative liability; - directly interferes with the rights of the complainant in separate proceedings, i.e. the rights to the complainant's defence in court and preparatory proceedings (Art. 42 of the Constitution of the Republic of Poland), in civil cases (Art. 379 item 5 of the Code of Civil Procedure), in administrative proceedings (Art. 10 § 1 of the Code of Civil Procedure); b) Art. 7 of the Code of Civil Procedure, Art. 8 of the Code of Civil Procedure in connection with Art. 77 § 1 of the Code of Civil Procedure due to the lack of a precise explanation of the factual circumstances resulting from the lack of conducting a reliable and proper evidentiary procedure justifying the claim that the complainant did not meet the conditions legalizing the processing specified in Art.6 or art. 9 of the GDPR in a situation where the complainant provided exhaustive answers about the specifics of the entity's activity and the need for further processing of personal data contained in the Medium. Thus, de facto, the necessary steps were not taken to thoroughly explain the factual circumstances and resolve the case and, as a consequence, the applicant's claim about the legal basis and the necessity for data processing was not examined and verified; According to the complainant, all of the above provisions were violated in the cassation appeal to an extent that could have an impact on the outcome of the case, which consisted in: - erroneous finding that the complainant does not have a legal basis for processing the personal data indicated in the decision, in a situation where such basis results in particular from art. 22 sec. 1 item 3 in connection with art. 5 sec. 1 item 2 of the Act of 14 July 1983 - the Act on Archives in connection with with the internal order of the Director of the Specialist Psychiatric Health Care Team [...] No. 72/06 of 20.12.2006; - failure to take all necessary steps to thoroughly explain the factual circumstances of the case and collect evidence, including failure to take sufficient steps to explain that the complainant processes personal data specified in the decision (as a component of court case files) based on the legal regime related to archiving and storage appropriate for court case files resulting from the Uniform Subject-Matter List of Files; - failure to examine the case on its merits II. provisions of substantive law: 1) art. 6 sec. 1 letter c GDPR in connection with art. 5 sec. 1 letter e GDPR in connection with recital 39 of the preamble to the GDPR in connection with art. 22 sec. 1 item 3 in connection with art. 5 sec. 1 point 2 of the Archives Act through its improper application as a result of omitting that the complainant has a legal basis for processing personal data in accordance with the principle of storage limitation, i.e. the Uniform Subject-Matter List of Files and the Office Instructions operating at the complainant's place and the obligation to conduct archiving imposed on the complainant by applicable legal provisions, which consequently condition the lawfulness of processing personal data located on the Medium; 2) Art. 6 sec. 1 letter e of the GDPR in connection with Art. 5 sec. 1 letter e of the GDPR in connection with recital 39 of the preamble to the GDPR through its improper application as a result of omitting that the complainant has a legal basis for processing personal data in accordance with the principle of storage limitation, i.e. the Uniform Subject-Matter List of Files and the Office Instructions operating at the complainant's place and taking into account the functioning of the SP ZOZ within the State archival network, which condition the lawfulness of processing personal data located on the Medium; 3) Art. 6 sec. 1 letter f of the GDPR due to its incorrect interpretation and the assumption that the processing of data carried out by the complainant was carried out "for the time being", in a situation where: a) the essence of the defense against potential criminal, civil, administrative claims generally occurs for the future; b) even the possible expiry of the limitation period does not mean that the claim ceases to exist, but only changes its nature to a so-called natural claim - because the complainant may raise the defense of limitation but does not have to do so, as a result of which even a time-barred claim may still be satisfied, and the data controller still has a purpose that justifies the processing of data contained in the Medium; c) The administrative body as well as the Voivodship Administrative Court did not analyze the mechanism for balancing interests, which would constitute the inadmissibility of the processing of personal data by the complainant in this specific case. 4) Art. 17 sec. 1 letter a of the GDPR in connection with Art. 17 sec. 3 letter f. b, d and e of the GDPR due to its improper application as a result of the erroneous assumption by the Provincial Administrative Court that the personal data on the Medium may be deleted by the complainant in the scope concerning J. A. without the need to process the personal data of other persons, in a situation where it is not possible to determine which files on the Medium concern only J. A. and in a situation where the only possibility of verifying which specific files with data should be deleted requires prior processing of all data on the Medium, and which processing of personal data of other natural persons may constitute a basis for the complainant to incur criminal, civil and administrative liability, and by failing to take into account that the complainant has a legal obligation related to the storage of data resulting from the Act on Archives and that the complainant may process the personal data on the Medium to establish, pursue or defend claims. Based on the above allegations, it was requested to stay the execution of the decision until the final resolution of the case by the Supreme Administrative Court; to consider the cassation appeal at a hearing; to set aside the contested judgment in its entirety and refer the case for reconsideration; ordering the authority to reimburse the complainant for the costs of the cassation proceedings, including the costs of legal representation, and reimbursement of the costs of the stamp duty on the power of attorney. Furthermore, the circumstances that were to justify the validity of the cassation appeal were requested to take additional evidence from a number of documents attached to it. In response to the cassation appeal, the authority requested its dismissal. In the reply to the response to the cassation appeal, the complainant responded to the allegations of the authority, at the same time maintaining the allegations, arguments and demands presented in the cassation appeal. In a letter of 24 May 2021, participant in the proceedings J. A. requested to dismiss the cassation appeal in its entirety, the application to stay the execution of the PUODO decision, and to dismiss the evidentiary motions, as irrelevant to the resolution of the case. By order of 13 July 2021, file reference III OSK 4727/21, the Supreme Administrative Court dismissed the application to stay the contested decision. The Supreme Administrative Court considered the following: Pursuant to art. 183 § 1 of the p.p.s.a., the Supreme Administrative Court examines the case within the limits of the cassation appeal, taking into consideration ex officio only the invalidity of the proceedings. In the case under consideration, none of the circumstances resulting in the invalidity of the proceedings, as referred to in art. 183 § 2 of the p.p.s.a., occur and none of the premises referred to in art. 189 of the p.p.s.a., which the Supreme Administrative Court considers ex officio when reviewing the judgment appealed against in the cassation appeal, occur. Therefore, the Supreme Administrative Court moved on to examine the cassation objections. The cassation appeal is subject to consideration, because the objection of violation of art. 141 § 4 of the p.p.s.a. proved to be justified. According to the content of the cited provision, the justification of an administrative court judgment should contain the following elements: "a concise presentation of the state of the case, the objections raised in the complaint, the positions of the other parties, the legal basis for the decision and its explanation. If, as a result of upholding the complaint, the case is to be reconsidered by the administrative body, the justification should also include indications as to further proceedings." The legislator introduced rigors into the administrative court procedure, which should be implemented by each administrative court judgment, so that the decision contained therein could be verified in terms of rationality and compliance with the law. Therefore, it is about a certain communicativeness of the decision issued by the administrative court, which can only be stated when the facts on which the court relied, the provisions from which it derived the substantive legal basis for its decision and the positions of the parties considered during the proceedings are disclosed. Generally speaking, it should be assumed that each administrative court judgment should implement the constitutional paradigm of procedural justice formulated as an element of the right to a court in the provisions of Article 45, Section 1 of the Constitution. Taking into account the above assumptions means that the effectiveness of the cassation objection to the violation of art. 141 § 4 p.p.s.a. requires demonstrating that the justification of the judgment of the court of first instance is not subject to verification, because the factual and legal basis of the decision contained therein cannot be determined. Fulfilling this requirement is not limited solely to a historical account of the course of the administrative proceedings, the content of the decision issued by the body as a result of its conduct and the reference to the provisions which, in the opinion of the court of first instance, apply to the case. The obligation to present the state of the case, the legal basis of the decision and its explanation is fulfilled when the court of first instance discloses all elements of the process of applying the law conducted by it. The content of the justification should therefore contain such elements that will allow for the reconstruction of the complete process of reviewing the legality of the action of the public administration body challenged by the complaint. The court of first instance should present the factual circumstances that it has accepted as the state of the case, the provisions of law that in its opinion are applicable to the case and the content of the legal norms derived from them, and then state what legal consequences for the assessment of the legality of the infected public administration activity are caused by correlating the state of the case with the adopted legal basis. Only a justification that meets the above requirements allows the parties to enter into a dispute with the findings and legal assessments presented therein, and the Supreme Administrative Court to conduct an appellate review. The justification of the judgment of the court of first instance does not meet these requirements. The main part of the considerations of the WSA consists of comments of a commentary nature and directly cited provisions of law (8 out of 9 pages). The court of first instance quotes in extenso the provisions of art. 4 points 1-3, art. 6 par. 1, art. 9, art. 17 par. 1, art. 57 par. 1 letter f), art. 58 par. 1 GDPR, and then states that the contested decision does not violate the law. The WSA did not demonstrate in any way a normative connection between the state of the case and the adopted legal basis for the decision. The WSA cites as its own the assessments formulated by the authority that after the termination of the employment contract with J. A., the complainant no longer had grounds for processing his personal data. The circumstance cited by the complainant that he processed personal data in order to defend against potential claims by J. A. The WSA – following the authority – considered the processing of personal data in advance to be unauthorised, "which finds no logical or legal justification". According to the WSA, the conclusion of an agreement between the complainant and J. A. after the termination of his employment contract excludes the legality of further processing of his personal data. In this state of affairs, according to the WSA, none of the premises legalising the processing of personal data referred to in Art. 6 sec. 1 or Art. 9 sec. 2 GDPR occurred. Referring to the issue at hand, the Supreme Administrative Court notes: - firstly, the WSA did not determine at all what personal data the complainant processes: whether these are "ordinary" personal data, the conditions for processing of which are set out in Article 6 sec. 1 of the GDPR, or so-called "sensitive" personal data, the processing of which may only take place in the event of the occurrence of the circumstances specified in Article 9 sec. 1 letters a-j of the GDPR. The WSA also did not determine what this processing consists of; - secondly, the WSA did not indicate at all the legal basis for its position that the processing of personal data for the purpose of defending against potential claims of J. A. is legally inadmissible. The court failed to notice that the possibility of such processing is expressly provided for in Article 17 sec. 3 letter e, which permits the processing of necessary personal data for the purpose of "establishing, pursuing or defending claims." Furthermore, in the complaint filed with the WSA, Article 6 sec. was indicated as the basis for the processing of personal data in the event of potential future claims. 1 letter f or 9 sec. 2 letter f) GDPR. The admissibility of applying these provisions was broadly justified in the complaint. The WSA did not address the complainant's arguments in this respect. It should be noted here that the processing of personal data on this basis, in connection with possible future claims, was assessed as admissible in the case law of the Supreme Administrative Court - see judgment of 20 February 2024, III OSK 2700/22; - thirdly, the WSA did not address the position expressed in the complaint that the settlement concluded with J. A. concerned only the termination of the employment relationship and did not cover any other possible claims at all; - fourthly, the complainant highlighted in the complaint that the computer used by J. A. when he was the complainant's employee contained files that could not be determined whether they were private or business in nature. It also could not be determined whether they contained personal data of third parties. Determining the issue in question requires an analysis of these files, which may lead to the unauthorized processing of personal data of third parties by the complainant, and thus may expose him to legal liability. The complainant's position in question was not assessed by the WSA; - fifthly, the complaint filed alleged that the contested decision does not directly indicate which personal data of J. A. are to be deleted, and specifically which files located on his computer contain this data and cannot be further processed. The WSA did not address the issue in question; - sixthly, the complaint pointed out that the contested decision does not indicate the parties to whom it is addressed. This issue was not assessed by the WSA; - seventh, in the course of the proceedings, in a letter dated 25 August 2020, the complainant stated that he could not delete the data from the work computer used by J. A., because this would be in conflict with the obligations imposed on him by the provisions governing the data archiving process. The complainant referred to specific provisions of generally applicable acts and internal acts. He also requested that evidence be admitted on the subject matter. The Provincial Administrative Court did not assess the issue in question; - eighth, in another letter dated 10 November 2020 (date of receipt by the Provincial Administrative Court on 13 November 2020), the complainant requested that additional documentary evidence be admitted and expanded his arguments regarding the position that he had a legal obligation to retain the data located on the work computer used by J. A.. The Provincial Administrative Court did not address the complainant's position. It also did not rule on the submitted evidentiary motions. In this state of affairs, the Supreme Administrative Court found that the contested judgment of the Provincial Administrative Court, due to the violation of art. 141 § 4 of the p.p.s.a., is not subject to appellate review and for this reason, pursuant to art. 185 § 1 of the p.p.s.a., is subject to annulment, and the case is referred to the Provincial Administrative Court in Warsaw for reconsideration. In conducting a new review of the legality of the contested decision, the Provincial Administrative Court will take into account the legal assessments presented in the concluding part of this justification, and in particular will conduct this review in compliance with the rigors provided for by the provisions of the p.p.s.a., including reference to the positions of the parties presented during the proceedings. The costs of the cassation proceedings were decided pursuant to art. 203 item 1 and art. 205 § 2 of the p.p.s.a. in conjunction with § 14 section 1 item 2 letter b. and the Regulation of the Minister of Justice of 22 October 2015 on fees for attorney services (Journal of Laws of 2023, item 1964, as amended).
