NSA - III OSK 1394/22
From GDPRhub
| NSA - III OSK 1394/22 | |
|---|---|
 | |
| Court: | NSA (Poland) |
| Jurisdiction: | Poland |
| Relevant Law: | Article 5(1)(f) GDPR Article 24(1) GDPR Article 25(1) GDPR Article 28(3) GDPR Article 32(1) GDPR Article 32(2) GDPR |
| Decided: | 12.06.2025 |
| Published: | 22.06.2025 |
| Parties: | Krajowa Szkoła Sądownictwa i Prokuratury (National School of Judiciary and Public Prosecutor) |
| National Case Number/Name: | III OSK 1394/22 |
| European Case Law Identifier: | |
| Appeal from: | UODO (Poland) DKN.5130.2024.2020 |
| Appeal to: | Unknown |
| Original Language(s): | Polish |
| Original Source: | NSA (in Polish) |
| Initial Contributor: | ap |
The Supreme Administrative Court confirmed a PLN 100,000 (€22,000) fine against a law school for failing to ensure the security of personal data leading to the disclosure of data relating to more than 50,000 users of its training platform for judges, prosecutors and law clerks
English Summary
Facts
The National School of Judiciary and Public Prosecutor (also known as KSSiP, the controller) notified the DPA regarding a data breach in April 2020. The national police notified the controller of the appearance of personal data on the internet related to the controller’s website domain. The data breach involved the access to a copy of the controller’s training site database created during a test migration to a new training platform. This led to the disclosure of personal data of over 50,000 people whose data was collected on the training platform, including judges, prosecutors and law clerks.
Following an investigation, the DPA fined the controller PLN 100,000 (€22,000) for failing to implement appropriate technical and organisational measures. According to the DPA, the controller had not properly taken the risks of processing into account, as it did not carry out an impact assessment on the effectiveness of the measures. Furthermore, the controller had not fulfilled several obligations as a controller. For example, the controller had not verified whether its instructions were being complied with by the company hired to carry out the database migration (the processor). In its decision, the DPA stated that the controller violated Articles 5(1)(f), Article 24(1), Article 25(1), 28(3), Article 32(1) and Article 32(2) GDPR.
The DPA decided not to fine the processor, as it had complied with its obligations under the GDPR; here, the DPA stated that the data breach occurred as a result of the actions taken by the controller.
The controller appealed the case to the Administrative Court, who upheld the reasoning of the DPA in August 2022. The controller later appealed the case to the Supreme Administrative Court. The controller argued that it had implemented sufficient technical and organisational measures, and that the Administrative Court had not had not fully assessed the factual circumstances of the case and had applied the GDPR erroneously by placing all of the responsibility following the data breach on the controller. Finally, the controller argued that it did not have the resources to verify whether an external company (the processor) deleted the database.
Holding
The Court first stated that the controller had not properly presented the appeal, and had placed obligations on the Administrative Court that went beyond its requirements under Polish administrative law. According to national administrative law, the court of first instance did not have competence to establish the factual circumstances of an administrative case.
The Court upheld the reasoning of the DPA and the Administrative Court. According to the Court, the controller did not provide the processor with all the information needed to process the data securely. Furthermore, the controller did not actively verify if the data had been securely processed until it was notified of the breach. The controller is responsible for the implementation of security measures by the processor as well, therefore the controller did not comply with its responsibilities under Articles 32 and 5(1)(f) GDPR.
The Court upheld the decision of the DPA to not fine the processor. According to the DPA, the data breach occurred as a result of the controller not understanding its role in relation to the processor. In addition, the principle of accountability under Article 5(2) GDPR places the burden of proof of compliance with the controller.
The Court upheld the PLN 100,000 (€22,000) fine on the controller, and emphasised the fact that over 50,000 people were affected by the data breach.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.
Date of judgment
2025-06-12 final judgment
Date of receipt
2022-06-06
Court
Supreme Administrative Court
Judges
Hanna Knysiak - Sudyka
Olga Żurawska - Matusiak
Zbigniew Ślusarczyk /Presiding Rapporteur/
Symbol with description
647 Cases related to personal data protection
Thematic entries
Personal data protection
Related references
II SA/Wa 1384/21 - Judgment of the Provincial Administrative Court in Warsaw of 2022-01-26
Accused body
Inspector General for Personal Data Protection
Content of the result
Caslation appeal dismissed
Referenced provisions
Journal of Laws 2019, item 1781, art. 102, sec. 1 and 3
Act of 10 May 2018 on the Protection of Personal Data (consolidated text)
OJ EU.L 2016 No. 119 item 1 art. 28 sec. 3, art. 32 sec. 1 and 2 of the Regulation of the European Parliament and the Council EU 2016/679 and of the Council EU 216/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC
Sentence
Supreme Administrative Court composed of: Presiding Judge: Supreme Administrative Court Judge Zbigniew Ślusarczyk (rapporteur) Judges: Supreme Administrative Court Judge Olga Żurawska-Matusiak Provincial Administrative Court Judge Hanna Knysiak-Sudyka Clerk of the Court: Assistant to Judge Przemysław Iżycki after considering on 12 June 2025 at the hearing in the General Administrative Chamber the cassation appeal of the National School of Judiciary and Public Prosecution against the judgment of the Provincial Administrative Court in Warsaw of 26 January 2022, reference number Act II SA/Wa 1384/21 in the case of the complaint of the National School of Judiciary and Public Prosecution against the decision of the President of the Personal Data Protection Office of 11 February 2021, No. DKN.5130.2024.2020 regarding the imposition of a fine for violating the provisions on the protection of personal data 1. dismisses the cassation appeal, 2. awards the National School of Judiciary and Public Prosecution to the President of the Personal Data Protection Office the amount of PLN 2,700 (in words: two thousand seven hundred) as reimbursement of the costs of the cassation proceedings.
Justification
The Voivodship Administrative Court in Warsaw, by its judgment of 26 January 2022, reference II SA/Wa 1384/21, based on art. 151 of the Act of 30 August 2002 - The Code of Administrative Court Procedure (Journal of Laws of 2019, item 2325, as amended, hereinafter referred to as "p.p.s.a.") dismissed the complaint of the National School of Judiciary and Public Prosecution against the decision of the President of the Personal Data Protection Office of 11 February 2021, No. DKN.5130.2024.2020 regarding the imposition of a fine for violating the provisions on the protection of personal data.
In the justification of the judgment, the Court of First Instance indicated that by the appealed decision, the President of the Personal Data Protection Office (hereinafter referred to as the "President of the UODO") found that the National School of Judiciary and Public Prosecution (hereinafter referred to as "KSSiP") violated the provisions of Art. 5 par. 1 letter f), Art. 25 par. 1, Art. 28 par. 3, Art. 32 par. 1 and 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council and of the Council of the EU 216/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU.L.119 of 4.05.2016, p. 1, as amended - hereinafter referred to as "GDPR") and imposed an administrative penalty on KSSiP in the amount of PLN 100,000 (one hundred thousand zlotys).
This decision was issued in connection with the violation of personal data protection reported by KSSiP on 9 April 2020. The authority found that the breach occurred in connection with the migration of data between the previous KSSiP Training Platform (szkolenia.kssip.gov.pl) and the target e-KSSiP Training Platform (ekssip.kssip.gov.pl) located on IT resources made available under the hosting agreement concluded between the National School of Judiciary and Public Prosecution and e. Sp. z o.o. with its registered office in W. In connection with the procedure adopted to launch the new platform, as indicated in the KSSiP letter of April 27, 2020, two stages of migration were planned: "test" and "production". The "test" migration took place on February 21-23, 2020, and the "production" migration - on February 28-1 March 2020.
The Authority indicated that on February 19-21, 2020, an employee of the KSSiP IT department, A. M. and the Director of the KSSiP IT Department, P. T., received messages from the contractor of the new platform, O. S.A., with a schedule for its implementation and the scope of responsibility for individual areas (KSSiP/[...]). On February 21, 2020, at 1:15 p.m., A. M. sent an e-mail to e. with a request to "(...) make a copy of the database [...]" and J...) pack the directory [...] from the server [...]" and transfer the above 2 copies to the new [...] eKSSiP server". In response, the e. employee, K. J., asked for clarification of the above request, among others. by indicating the IP addresses of the servers and full paths to the source and target resources, indicating ignorance of the internal designations of the KSSiP services and resources. After A. M. provided this information, on the same day, K. J. informed in an e-mail at 6:44 p.m. that the "copying" had been completed. The above e-mails are attachments to the letter e. dated July 27, 2020, which are identical to the explanations provided in point 3 of the KSSiP letter dated April 27, 2020. On February 28, 2020 at 2:12 p.m., due to the fulfilled assumptions of the "test" migration, A. M., "[in connection] with the migration being carried out (...)" requested the performance of activities analogous to those performed on February 21, 2020, immediately indicating the IP addresses and full paths to the source and target resources. The above, on the same day, was implemented and confirmed by K. J.'s correspondence. Then, on April 2, 2020, an unknown person posted a link to a file hosted on the [...] platform on the [...] website, constituting a copy of the user table from the KSSiP Training Platform database.
The President of the UODO indicated that the number of people affected by the breach was 50,283. In addition, the authority took into account that the breach of data confidentiality concerned persons practicing professions and holding positions as judges, judicial assessors, prosecutors and prosecutor's assessors, court registrars, assistants to judges, assistants to prosecutors, professional probation officers and officials of courts and prosecutor's offices, as well as some lecturers conducting continuing training, a few KSSiP trainees and persons whose accounts were activated on the basis of individual decisions, including employees of the Ministry of Justice.
The President of the UODO stated that in accordance with the wording of art. 24 sec. 1 GDPR, taking into account the nature, scope, context and purposes of processing and the risk of breaching the rights or freedoms of natural persons of varying likelihood and severity, the controller shall implement appropriate technical and organisational measures to ensure that processing takes place in accordance with this Regulation and to be able to demonstrate it. The National School of Judiciary and Public Prosecution based in Kraków did not take sufficient measures to verify the security of the processing environment before the commencement of migration activities and after their completion, in particular it did not verify in the period from 21 February 2020 to 7 April 2020 whether a copy of the database from 21 February 2020 was still in the location indicated by the National School of Judiciary and Public Prosecution. By deciding not to involve the processing entity in the migration process and not to provide full information on the actions taken and the expected results, the controller did not ensure that the personal data being processed were adequately secured. The controller only undertook this verification on the day the infringement was found. According to the authority, this constitutes a gross negligence of the obligations of the National School of Judiciary and Public Prosecution and a breach of the provisions of Art. 32 sec. 1 and sec. 2 of the GDPR.
The authority also found that KSSiP violated art. 28 sec. 3 point a) of the GDPR, according to which the data processing entrustment agreement states, among other things, that the processor processes personal data only on the documented order of the administrator. While to some extent this element can be interpreted from § 3 point 3 of the main agreement, according to which "notices of faults related to hosting services, including their unavailability, shall be made in writing, by fax or e-mail", in the opinion of the President of the UODO, the indicated provision of the agreement is insufficient. By entrusting the processing of personal data to e., KSSiP did not include in the agreement the obligation of the processor to process personal data only on the documented order of the administrator, which constitutes a violation of art. 28 sec. 3 letter a) of the GDPR.
When imposing the administrative fine, the authority took into account, in particular, the categories of personal data affected by the breach of personal data protection, the nature and gravity of the breach, taking into account the number of injured parties, the duration of the breach, the unintentional nature of the breach and the high degree of responsibility of the controller. When determining the amount of the administrative fine, the President of the Personal Data Protection Office also took into account the actions taken by the controller to minimise the damage suffered by the data subjects, but nevertheless found that the maximum statutory fine imposed was still disproportionately low in relation to the scale and gravity of the breach from the perspective of the provisions of the GDPR.
In dismissing the complaint, the Court of First Instance found that the contested decision was correct. According to the Court, it is indisputable that KSSiP, by entrusting the processing of personal data to e., did not include in the personal data processing entrustment agreement a category of persons and did not specify the type of personal data by indicating their category, which was required under Article 28 paragraph 3 of the GDPR. Moreover, KSSiP, by entrusting the processing of personal data to e., did not include in the agreement the obligation of the processor to process personal data only on the documented order of the controller, which constitutes a violation of art. 28 sec. 3 letter a) of the GDPR.
Moving on to the assessment of the violation of art. 32 sec. 1 and 2 of the GDPR, the Court of First Instance noted that KSSiP, in accordance with the purpose and method of processing adopted by it, decided that no copy of the database should remain after the completion of the migration process. However, both before and after the ordering of the activity on 21 February 2020 and 28 February 2020, the controller did not verify whether the said copy was still on the resources of KSSiP. The court shared the authority's position that since the controller decided that the said copy of the database should be deleted, it was his duty to verify whether this action had been performed. Even if, as a result of an error, e.'s employee did not delete the copy made, the controller was still obliged to verify whether the indicated location ensures the security of processing. The administrator is the initiator of the actions taken as the entity deciding on the purposes and methods of processing. In accordance with the service provision agreement, the environment in which this processing is carried out has been made available to him and he is primarily responsible for its security, and as it results from the service provision agreement, if necessary, he uses the assistance of the processor.
The Provincial Administrative Court in Warsaw also agreed with the authority's statement that determining whether the "leak" of data occurred as a result of an error by an e. employee or as a result of other factors was not decisive or required to issue a decision. The authority assessed the administrator's activities through the prism of the applicable provisions. Although the factual circumstances established in the case do not provide an answer at what stage the irregularities occurred that directly resulted in the "leak" of data, it was clearly established what procedures were broken and what provisions were violated. According to the Court, the authority correctly assumed that in the above respect the responsibility lies with the data administrator and not the processing entity. The role of the administrator was to implement the regulations in such a form as to ensure security in the process of processing personal data.
Taking the above into account, in the opinion of the Court of First Instance, KSSIP, as the controller of personal data, insufficiently assessed the effectiveness of technical and organizational measures to ensure the security of processing such data and thus violated Art. 5 sec. 1 letter e, Art. 5 sec. 2, Art. 24 sec. 1, Art. 25 sec. 1, art. 28 sec. 1 and 3, art. 32 sec. 1 and 2 of the GDPR. The court found that the President of the UODO correctly imposed an administrative fine on the KSSiP and discontinued the proceedings in the case of the violation of the GDPR by e.
The National School of Judiciary and Public Prosecution filed a cassation appeal, challenging the above judgment in its entirety. It alleged a violation of the procedural provisions, which had a significant impact on the outcome of the case (item I), i.e.:
1. art. 134 sec. 1 in connection with art. 133 sec. 1 and art. 141 sec. 4 of the p.p.s.a. affecting the decision, due to the incomplete and incorrect analysis of the factual circumstances carried out by the Court of First Instance, which resulted in it incorrectly adopting the factual circumstances established by the President of the Personal Data Protection Office (hereinafter referred to as the "authority") as the basis for its decision, i.e. it found that the complainant had insufficiently assessed the effectiveness of technical and organizational measures intended to ensure the security of personal data processing, without taking into account that any verification by the complainant in the above-mentioned scope - given the nature of the error of an employee of e. sp. z o.o. (hereinafter also referred to as the "processing entity") - was not able to prevent the infringement and access to the database by third parties, because this error consisted in placing a file with the database in a public location and then not deleting it, and as a consequence, the lack of factual findings taking into account the individual nature of the case and limiting itself solely to an abstract assessment that the complainant had not assessed the risk in terms of the possibility of violating the principle of confidentiality of personal data, i.e. in isolation from the realities of this case,
2. Article 145 § 1 item 1 letter c of the p.p.s.a. in connection with Art. 7, Art. 77 § 1, Art. 80, Art. 84 § 1, Art. 97 § 1 item 4 and Art. 107 § 3 of the Code of Administrative Procedure by dismissing the complaint, even though the appealed decision of the authority was issued without a detailed explanation of the factual circumstances of the case and without exhaustive collection and consideration of evidence, including the determination of the causes of the personal data leak, which resulted in the erroneous recognition that the complainant did not meet the requirements specified in Art. 32 sec. 1 and 2 of the GDPR, while a comprehensive analysis of the evidence collected should have led the Court of First Instance to establish that the appellant had implemented technical measures to protect the processed personal data adequate to the state of technical knowledge, the cost of implementation and the nature, scope, context and purpose of processing, known on 21 February 2020,
3. Art. 145 § 1 point 1 letter c of the p.p.s.a. in connection with Art. 105 § 1 of the Code of Administrative Procedure in connection with Art. 7 sec. 1 of the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2019, item 1781) by erroneously assuming that the authority had justifiably discontinued the proceedings against the processing entity due to the lack of grounds for establishing that e. had breached the obligations arising from Art. 32 sec. 1 and 2 in connection with Art. 28 sec. 3 letter f GDPR in a situation where an employee of the processing entity had the information necessary for the correct processing of data and should have helped the complainant to fulfill the obligations specified in art. 32-36 GDPR, which he failed to do.
In addition, KSSiP alleged a violation of the provisions of substantive law (item II):
1. art. 32 sec. 1 and 2 in connection with art. 5 sec. 1 letter f, art. 24 sec. 1 and art. 25 sec. 1 GDPR due to the incorrect interpretation and assumption that the complainant did not assess the risk of a breach of the principle of confidentiality of personal data resulting from the threat of exporting personal data from the system to a publicly accessible Internet platform in a situation where the content of the order did not include transferring the database using the public Internet, and the provision of services (including transferring the database) was commissioned to an entity that, within the scope of its professional activity, is engaged in performing such activities and proves to have documents confirming knowledge of the principles and techniques of securing information in IT technologies,
2. Art. 28 sec. 1 GDPR by improper application and the assumption that the complainant had violated this provision, which requires personal data controllers to use the services of entities processing such that provide sufficient guarantees for the implementation of appropriate technical and organizational measures so that the processing meets the requirements of this Regulation and protects the rights of data subjects, and therefore the Court of First Instance questioned the choice of the complainant's processing entity, in a situation where it was simultaneously recognized that the authority had justifiably discontinued the proceedings also initiated against e. sp. z o.o. due to the lack of any violations of the provisions of the GDPR by that entity,
3. Art. 102 sec. 3 of the Personal Data Protection Act in connection with Art. 83 sec. 2 letters c, e, f and h of the GDPR by incorrect interpretation and the assumption by the Court of First Instance that the authority took into account, when imposing the penalty, mitigating circumstances affecting the penalty in the event of its imposition in the maximum amount permitted by law, i.e. PLN 100,000,
4. Art. 28 sec. 3 GDPR due to its incorrect interpretation (following the erroneous assessment made by the authority) and the assumption, in the absence of a provision in the agreement between the complainant and the processor obliging the processor to process data only upon the documented order of the controller, that this agreement infringes the above provision of law, without taking into account that the entrustment of processing took place on the basis of an agreement subject to national law, and therefore national provisions on the interpretation and effects of such agreements apply, and the correct determination of the legal effects of the data processing entrustment agreement, constituting Annex No. 5 to the agreement of 16 December 2019 No. 2688/2019 in the context of Art. 56 of the Act of 23 April 1964 - the Civil Code (hereinafter referred to as the "Civil Code") and taking into account, in accordance with the directive resulting from Art. 65 § 2 of the Civil Code, not so much the wording of the agreement, but the consistent intention of its parties, should lead to the conclusion that this agreement met the requirements resulting from Art. 28 sec. 3 GDPR.
Based on the allegations formulated in this way, the KSSiP requested that the contested judgment be set aside in its entirety and that the case be referred back to the Court of First Instance for reconsideration. It also requested that the costs of the proceedings be awarded to the Appellant, including the costs of legal representation according to the statutory standards and the refund of the stamp duty on the power of attorney.
In the justification of the cassation appeal, the KSSiP emphasized that the Court of First Instance considered it unnecessary to determine the causes of the personal data leak, and yet held the Appellant alone liable for the violation of the aforementioned provisions. According to the party, the reasoning of the Court of First Instance that the data controller should not use external companies in practice, and should expand IT departments beyond the need, is unjustified. Without having highly qualified staff, it is not able to check the activities of the external company, including whether it deleted copies of the database on its servers, did not have knowledge of its creation and that is why it concluded a contract for the provision of services with an external entity, selected in the conditions of the public procurement procedure, which holds documents confirming the security of IT systems, because it does not have the staff resources to perform the database migration.
According to the KSSiP, imposing a financial penalty on this entity was premature. Evidence from an expert opinion in the field of IT or another specialty relevant to the event should have been admitted, as the KSSiP motion did not aim to "duplicate" the powers of the prosecutor's office or the criminal court, but was justified by the desire to obtain evidence allowing for making important findings in the case.
In the opinion of the appellant, the Court erroneously accepted the discontinuation of the proceedings against e. sp. z o.o. The method of transferring the database via a public directory, adopted on the basis of an independent decision of an employee of the processing entity, was improper regardless of the content of the database. An employee of e.sp. z o.o., in order to "facilitate" copying the database, placed a temporary copy in a public directory. Therefore, the method of copying via the public directory was an error in the field of professional art and a violation of the agreement between the parties, as well as the provisions of the GDPR. An employee of the processing entity, professionally engaged in such activities, without the knowledge and will of the complainant, created a temporary copy of the database in a secured location of the KSSiP training platform, transferred it to a "publicly open" location, and from there sent it via a public network to a secure location on the e-KSSiP training platform. After performing the above action, he neither removed the temporary copy from the "publicly open" location, blocked access to this copy, nor notified anyone about how he had carried out the order.
Referring to the amount of the imposed fine, the KSSiP indicated that it had taken a number of actions to remedy the breach and minimise the negative effects on the data subjects. Therefore, since both the authority and the Court of First Instance found that there were extenuating circumstances on the part of the complainant, it was necessary to determine the amount of the fine taking them into account, which the authority failed to do and which was incorrectly approved by the Court of First Instance.
In response to the cassation appeal, the President of the UODO requested that the cassation appeal be dismissed.
In the justification of the response to the cassation appeal, he indicated that he maintained his previous position in its entirety. Referring to the role of the processing entity, he emphasised that the use by the KSSiP in the process of processing personal data of the support of a professional processing entity, referred to as "risk transfer", does not at all imply the state of "transfer of responsibility" from the administrator to the processing entity in the scope of the obligations incumbent on it under the provisions of the GDPR, but refers to the state of their cooperation specified in Article 28, paragraph 3 letters c) and f) of the GDPR and the principle of mutual responsibility for the security of personal data processing. Therefore, in the light of the norm of art. 32 sec. 1 of the GDPR, the administrator's responsibility for ensuring the security of personal data processing by entrusting their processing to a processor is not excluded. Adopting a different interpretation of the provision would lead to the erroneous conclusion that at the time of concluding a personal data entrustment agreement, the administrator is de facto excluded from the provisions of the GDPR obliging him to ensure the security of the processed data.
Referring to the scope of the evidentiary proceedings conducted, the body presented that it is the administrator (KSSiP) who is responsible for compliance with one of the fundamental principles of the GDPR, i.e. the principle of ensuring confidentiality. He also bears the burden of proof in the event of doubts in this respect (the obligation to prove their compliance).
The President of the UODO also stressed that it is not important whether the employee of the processing entity committed an act provided for in the provisions of criminal law, because this does not entitle to state that the processing entity violated the provisions of substantive law, which were the subject of the administrative proceedings in which the contested decision was issued, i.e. the obligations of KSSiP as the data controller and e. Sp. z o.o. as the processing entity, resulting from the provisions of the GDPR.
The Supreme Administrative Court considered the following:
Pursuant to art. 183 § 1 of the Act of 30 August 2002 - The Code of Administrative Court Procedure (consolidated text: Journal of Laws of 2024, item 935), hereinafter referred to as the p.p.s.a., the Supreme Administrative Court examines the case within the limits of the cassation appeal, taking into account ex officio only the invalidity of the proceedings. In the case under consideration, there are no circumstances resulting in the invalidity of the proceedings, as referred to in Article 183 § 2 of the p.p.s.a., and none of the premises referred to in Article 189 of the p.p.s.a., which the Supreme Administrative Court considers ex officio when reviewing the judgment appealed against in the cassation appeal. In these circumstances, only the allegations raised in the cassation appeal to justify the grounds for the cassation appeal were subject to review in the case.
The cassation appeal alleged both a breach of the provisions of the procedure and of substantive law. In such a state of affairs, the Supreme Administrative Court will first address the allegations of a breach of the provisions of the procedure.
A cassation appeal may be based on the following grounds:
1) a breach of substantive law through its incorrect interpretation or incorrect application,
2) a breach of the provisions of the procedure, if this irregularity could have a significant impact on the outcome of the case (Article 174 of the p.p.s.a.).
The limits of the cassation appeal are determined by the grounds indicated therein. Due to the way in which the cassation appeal is constructed in this case, it should be recalled that the Supreme Administrative Court, due to the limitations resulting from the indicated legal regulations, cannot specify the allegations of the cassation appeal on its own, specify them or otherwise correct them. The fact that the Supreme Administrative Court is bound by the limits of the cassation appeal also means that it is bound by the grounds of appeal indicated therein, which determine the scope of the cassation review that the Supreme Administrative Court exercises on the basis and within the limits of the law (Article 7 of the Constitution of the Republic of Poland) - in order to determine the possible defect of the contested judgment. The fact that the Supreme Administrative Court is bound by the limits of the cassation appeal excludes the possibility of presuming the intention of the party filing this means of appeal, specifying its allegations or supplementing the deficiencies occurring in it concerning the grounds of the cassation appeal and their justification.
Due to the structural requirements of cassation appeals, their preparation has been entrusted to professional entities, whose expertise should guarantee the correct construction of objections, in accordance with the provisions of the p.p.s.a. It is therefore the responsibility of the author of the cassation appeal to indicate specific provisions of substantive law or procedural provisions that, in his opinion, the Court of First Instance violated and to precisely explain what their improper application or erroneous interpretation consisted in, in relation to substantive law, or to demonstrate the significant impact of the violation of procedural law on the resolution of the case by the Court of First Instance. It should be emphasized that in accordance with the position adopted in the resolution of the full bench of the Supreme Administrative Court of 26 October 2009, I OPS 10/09, "Citing the grounds for cassation, understood as indicating the provisions that - in the opinion of the person lodging the cassation appeal - were violated by the provincial administrative court, imposes on the Supreme Administrative Court (...) the obligation to address all the objections cited in the grounds for cassation". The Supreme Administrative Court may only fulfil this obligation if the person lodging the cassation appeal correctly specifies which provisions, in his opinion, the provincial administrative court has breached and what this breach consisted of.
The cassation appeal in this case was drawn up carelessly, which should be referred to in particular with regard to the first allegation of violation of Article 134 § 1 in connection with Article 133 § 1 and Article 141 § 4 of the p.p.s.a., due to an incomplete and erroneous analysis of the factual circumstances carried out by the Court of First Instance. In relation to the allegation formulated in this way, it should be recalled that when reviewing the legality of the contested decision, the provincial administrative court does not conduct evidentiary proceedings and does not assess the evidence on behalf of the administrative body (Article 80 of the Code of Administrative Procedure). The Court of First Instance cannot be accused of an erroneous analysis of the factual circumstances within the framework of the allegation of violation of Article 133 § 1, Article 134 § 1 and art. 141 § 4 of the p.p.s.a. It results from the first of the cited provisions that "[t]he court shall issue a judgment after closing the hearing on the basis of the case files, unless the body has failed to fulfil the obligation referred to in art. 54 § 2. The judgment may be issued at a closed session in simplified proceedings or if the statute so provides". The above provision results in the obligation addressed to the court of first instance to adjudicate on the basis of the case files, while art. 133 § 1 of the p.p.s.a. does not constitute a basis for the assessment of the evidence by the court. In case law, it is assumed that the obligation to issue a judgment on the basis of the case files means only a prohibition to go beyond the material contained in the case files. On the other hand, a violation of the obligation specified in art. 133 § 1 of the p.p.s.a. the principle of adjudicating on the basis of case files could constitute an effective basis for cassation, e.g. in the event of dismissing a complaint despite incomplete case files, omitting a significant part of these files, or basing the judgment on the court's own findings, i.e. evidence or facts not reflected in the case files. However, a distinction should be made between subjecting the activities of the public administration to judicial review based on material other than the case files, and issuing a judgment on the basis of the case files, with the adoption of a different assessment of the evidence contained in these files (judgment of the Supreme Administrative Court of 3 April 2025, II OSK 616/24). Similarly, Article 134 § 1 of the p.p.s.a. establishes the non-binding of the court with the objections and motions of the complaint. On the violation of the norm resulting from the provision of Article 134 § 1 of the p.p.s.a. it could be said that the court went beyond the bounds of the case in which the complaint was filed, or - despite the obligation resulting from this provision - did not go beyond the allegations and conclusions of the complaint, e.g. by failing to notice violations of the law that were not cited by the complainant and which the Court of First Instance was obliged to take into account ex officio (judgment of the Supreme Administrative Court of 17 January 2025, III OSK 2446/23).
In turn, art. 141 § 4 p.p.s.a. specifies the requirements for the justification of the judgment, which should contain a concise presentation of the state of the case, the allegations raised in the complaint, the positions of the other parties, the legal basis for the decision and its explanation. The allegation of violation of art. 141 § 4 p.p.s.a. may be effectively raised in two cases: when the justification of the judgment does not contain all the elements listed in this provision and when, as part of the presentation of the state of the case, the provincial administrative court does not indicate what and why the factual situation it adopted as the basis for the ruling. Since it follows from the content of art. 141 § 4 of the p.p.s.a. that the justification of a judgment must contain a description of the factual circumstances of the case and the positions of the parties to the proceedings, including an indication of the objections of the complaint and the arguments of the opposing party and the position of the court together with a properly justified legal basis, it should be assumed that the inclusion of these elements in the justification is intended to enable the reconstruction of the court's reasoning that led to a given decision. Furthermore, the defectiveness of the justification of a judgment may constitute the subject of an effective cassation objection under art. 141 § 4 of the p.p.s.a. in a situation where it is drawn up in such a way that appellate review of the contested judgment is impossible, and this happens when there is no possibility of an unambiguous reconstruction of the basis for the decision (judgment of the Supreme Administrative Court of 25 April 2025, III OSK 943/24). Such a situation did not occur in this case. Combating the factual findings adopted by the Court of First Instance cannot be done by means of an allegation of violation of art. 141 § 4 p.p.s.a. At the same time, the contested judgment contains all the elements required under the aforementioned provision and is subject to appellate review.
According to the cited resolution of the full bench of the Supreme Administrative Court of 26 October 2009, I OPS 10/09, "a clear distinction should be made between the control of public administration (deciding a court-administrative case) and the performance of public administration (deciding an administrative case). An administrative court is not competent to issue a decision on its own in place of a public administration body. In light of the constitutional model of judicial control of the activities of public administration, the administrative court of first instance does not, in principle, have the competence to establish the factual circumstances that are the background of an administrative case (see also art. 133 § 1 of the p.p.s.a.). This task belongs to the public administration body. An element of the control of the legality of the actions of a public administration body is the court's obligation to examine whether, when establishing the factual circumstances, the body has not violated the procedural provisions that allow for the implementation of the principle of objective truth. A violation of this type of regulation (including art. 7, art. 77 § 1, art. 80 of the Code of Administrative Procedure) results in illegality of the body's decision". Taking the above into account, in a situation where the party cites in the petitum of the cassation appeal only the allegation of infringement of the law by the Provincial Administrative Court, without linking it to the allegation of infringement of the law by the administrative body, it is not possible to refer to the allegation formulated in this way on the merits. The above findings determine the unfoundedness of the first allegation of infringement of the procedural provisions.
Moving on to the assessment of the second allegation, in the case there was no violation of art. 145 § 1 item 1 letter c p.p.s.a. in connection with art. 7, art. 77 § 1, art. 80, art. 84 § 1, art. 97 § 1 item 4 and art. 107 § 3 of the Code of Administrative Procedure. The National School of Judiciary and Public Prosecution sees violations of these provisions in the dismissal of the complaint, despite the fact that - in the opinion of the party - the contested decision of the body was issued without a detailed explanation of the factual circumstances of the case and without an exhaustive collection and consideration of evidence, including in terms of determining the causes of the leak of personal data, which was to result in the erroneous recognition that the KSSiP did not meet the requirements specified in art. 32 sec. 1 and 2 of the GDPR.
As a rule, the subject and scope of the evidentiary proceedings conducted by the administrative body are determined by the provisions of substantive administrative law. They shape the factual circumstances relevant for the purpose of subsuming a legal norm by way of an administrative decision. In the contested decision, the President of the UODO found that the KSSiP violated, among others, art. 32 sec. 1 and 2 of the GDPR, which provisions specify the administrator's obligations in the scope of implementing appropriate technical and organizational measures in order to ensure security corresponding to the risk of violating the rights or freedoms of natural persons. At the same time, in accordance with art. 32 sec. 2 GDPR "[w]hen assessing whether the level of security is adequate, particular account shall be taken of the risks associated with processing, in particular those resulting from accidental or unlawful destruction, loss, modification, unauthorized disclosure or unauthorized access to personal data transmitted, stored or otherwise processed". The Supreme Administrative Court shares the previous position that "technical and organizational measures appropriate under Art. 32 sec. 1 of the GDPR are not effective measures in every case, but those whose compliance could have been objectively required of the entity in question (the controller or the processor) at the time and in the circumstances of access to personal data. (...) a financial penalty for a violation of Art. 32 of the GDPR is not automatic, i.e. a sanction for unauthorized access to personal data as a result of a prohibited act committed by a third party" (judgment of the Supreme Administrative Court of 9 February 2023, III OSK 3945/21).
In the circumstances of the case, the Court of First Instance correctly found that there was no violation by the authority of Article 7, Article 77 § 1, Article 80, Article 84 § 1, Article 97 § 1 item 4 and Article 107 § 3 of the Code of Administrative Procedure. The President of the UODO conducted evidentiary proceedings regarding the factual circumstances relevant to the case, from the perspective of the principles of the controller's liability. The result of these proceedings turned out to be negative for the KSSiP. The appellant did not challenge the findings in the cassation appeal, according to which it did not take sufficient actions to verify the security of the processing environment before the commencement of the migration activities and after their completion, in particular, it did not verify in the period from 21 February 2020 to 7 April 2020 whether a copy of the database from 21 February 2020 was still in the location indicated by the KSSiP. By deciding not to involve the processing entity in the migration process and not to provide full information about the activities undertaken and the expected results, the controller did not ensure that the personal data being processed were adequately secured. As the body accepted and which the WSA in Warsaw rightly shared, the controller undertook this verification only on the day the infringement was found, which constitutes a violation by the KSSiP of Article 32 paragraphs 1 and 2 of the GDPR. It should be emphasised that the controller's liability for a breach of personal data protection, although it is not absolute, is objective liability. The established case law of the Constitutional Tribunal states that an administrative fine "is not a consequence of committing a prohibited act, but a result of a state of affairs contrary to the law, which means that the assessment of the perpetrator's attitude towards the act does not fall within the scope of objective liability" (Constitutional Tribunal judgment of 21 October 2015, P 32/12, see also the Constitutional Tribunal judgment of 31 March 2008, SK 75/06). Thus, the controller is also liable for the actions of persons and entities dependent on it, with the help of which it processes personal data. In the circumstances of this case, this is an important issue, because the leak of personal data occurred not as a result of interference by a third party, but as a result of failure to apply appropriate technical and organisational measures in the implementation of the data migration process. Failure to fulfil these obligations resulted in the downloading of a copy of the database from 21 February 2020 by unknown and unauthorized persons, which constitutes a violation by KSSiP of the principle of confidentiality expressed in art. 5 sec. 1 letter f) of the GDPR by processing personal data in a manner that does not ensure adequate security of personal data.
The cassation appeal therefore incorrectly argues that if the authority had made findings as to what caused the data leak, it would only have been possible to assess whether the controller had taken into account the risk of violating the rights or freedoms of natural persons, and therefore whether these circumstances had an adequate causal relationship and could be accused of violating art. 32 sec. 1 of the GDPR. As the Court of First Instance correctly concluded, the President of the UODO correctly assumed that since the controller had decided that the aforementioned copy of the database should be deleted, it was his duty to verify whether this action had been performed. Even if, as a result of an error, the employee of e. did not delete the copy made, the administrator was still obliged to verify whether the indicated location ensures the security of processing. The administrator is the initiator of the actions taken as the entity deciding on the purposes and methods of processing. The circumstance of whether the "leak" of data occurred as a result of the error of the employee of e. or as a result of other factors is irrelevant in terms of the administrator's liability under Article 32 of the GDPR. Thus, the President of the UODO correctly assumed that for the authority it is not a decisive factor and is not required to issue a decision. The authority assesses the administrator's activities through the prism of the applicable provisions, and the established factual circumstances allowed for attributing responsibility for the "leak" of personal data to the National School of Judiciary and Public Prosecution.
The third plea in law regarding the infringement of the provisions of the procedure focuses on the infringement by the Court of First Instance of Article 145 § 1 item 1 letter c of the p.p.s.a. in connection with Article 105 § 1 of the Code of Administrative Procedure in connection with Article 7 sec. 1 of the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2019, item 1781) by erroneously assuming that the authority justifiably discontinued the proceedings against the processor due to the lack of grounds for determining that e. had violated the obligations arising from Art. 32 paragraphs 1 and 2 in conjunction with Art. 28 paragraph 3 letter f of the GDPR in a situation where an employee of the processor had the information necessary for the correct processing of data and should have helped the complainant to fulfil the obligations indicated in Art. 32-36 of the GDPR. Referring to the above, it should be emphasized that under Art. 32 and Art. 28 of the GDPR, the use by the controller of the services of a processor does not release the controller from liability for a breach of personal data protection. Based on Art. 32 GDPR the controller is also responsible for the implementation of appropriate technical and organizational measures by the processor, and a separate obligation is to regularly test, measure and assess the effectiveness of technical and organizational measures to ensure the security of processing. The controller therefore decides on the purposes of processing and ensures the accuracy and security of data by the processor. The doctrine indicates that "In the case of entrusting data processing, the controller still decides on the purpose and method of data processing and is responsible for meeting the requirements specified in the provisions of the commented regulation, while the processor is only entitled to perform the entrusted (commissioned) processing activities, and is also obliged to appropriately secure the data processing, for which he is responsible" (P. Fajgielski [in:] Commentary to Regulation No. 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [in:] General Data Protection Regulation. Personal Data Protection Act. Commentary, 2nd ed., Warsaw 2022, art. 28, p. 375).
The President of the UODO rightly points out in his response to the cassation appeal that the use by the KSSiP in the process of processing personal data of the support of a professional processing entity, referred to as "risk transfer", does not at all imply the state of "transfer of responsibility" from the administrator to the processing entity in the scope of the obligations incumbent on it under the provisions of the GDPR, but refers to the state of their cooperation specified on the basis of art. 28 sec. 3 letters c) and f) of the GDPR and incurred on the basis of mutual responsibility for the security of personal data processing processes. Therefore, it should be pointed out that in the light of the norm of art. 32 sec. 1 of the GDPR, the administrator's responsibility for ensuring the security of personal data processing by entrusting their processing to the processing entity is not excluded. Adopting a different interpretation of the provision would lead to the erroneous conclusion that at the time of concluding a personal data entrustment agreement, the administrator is de facto excluded from the provisions of the GDPR obliging him to ensure the security of the processed data.
Regardless of the above, the authority correctly discontinued the proceedings against the processor, i.e. e. sp. z o.o. During the administrative proceedings, the President of the UODO did not find any irregularities on the part of this entity. The factual circumstances established in the case do not provide an answer at what stage the irregularities occurred that directly resulted in the "leak" of data, but clearly indicate what procedures were broken and what provisions were violated. In this case, the key significance should be attributed to the finding that the breach of data protection occurred as a result of the lack of understanding by the controller of the role it plays in the relationship with the processor. The processor, i.e. e., was not involved or informed about the nature of the activities undertaken, which the processor repeatedly emphasized in the explanations provided. The employee of e., K. J., had no information about the changes introduced by KSSiP in the processes of processing personal data contained in the file being a copy of the database from February 21, 2020, and the activities carried out by the above-mentioned employee constituted the implementation of tasks arising from the agreement for the provision of services, as part of the technical support of KSSiP. The President of the UODO was therefore right to find that the processor fulfilled the obligations arising from the entrustment agreement and the main agreement, and also applied the organizational measures adopted by it to ensure the security of IT systems. This purpose is indicated, among others, by the technical support referred to in Annex No. 1 to the main agreement. In confirmation of this circumstance, the authority indicated a number of pieces of evidence that were not effectively challenged by the appellant in cassation. At the same time, in the light of Article 5 sec. 2 of the GDPR, the administrator is responsible for compliance with the provisions of sec. 1 and must be able to demonstrate compliance with them ("accountability" of the administrator). The NSA shares the position of the President of the UODO that the administrator (KSSiP) is responsible for compliance with one of the fundamental principles of the GDPR, i.e. the principle of ensuring confidentiality. He also bears the burden of proof in the event of doubts in this respect (the obligation to demonstrate compliance). As the authority found, the controller did not take sufficient measures to verify the security of the processing environment before and after the migration activities began, in particular, it did not verify in the period from February 21, 2020 to April 7, 2020 whether the location indicated by the National School of Judiciary and Public Prosecution still contained a copy of the database from February 21, 2020. By deciding not to involve the processor in the migration process and not to provide full information about the activities undertaken and the expected results, the controller did not ensure that the personal data being processed was adequately secured. Therefore, the controller is responsible for the breach.
Taking the above into account, the allegations of violation of the provisions of the procedure turned out to be unfounded. The Court of First Instance correctly assumed, following the President of the UODO, that in the case, factual circumstances significant from the perspective of the GDPR provisions were established, which allowed for attributing responsibility for the breach of personal data protection solely to the National School of Judiciary and Public Prosecution. The findings of the authority referring to the lack of involvement or information by KSSiP on the processing entity, i.e. e. sp. z o.o., about the nature of the activities undertaken proved crucial for the outcome of the case and for the assessment of the correctness of the application of the provisions of substantive law, as a result of which the employee of e. had no information about the changes introduced by KSSiP in the processing of personal data contained in the file being a copy of the database of February 21, 2020. The Supreme Administrative Court emphasizes that the irrelevant circumstance from the perspective of judicial review of the legality of the decision of the President of the Personal Data Protection Office of February 11, 2021, No. DKN.5130.2024.2020 was the knowledge and personal liability for the infringement of the employee of e. K. J.. The activities carried out by the above-mentioned employee constituted solely the implementation of technical support tasks resulting from the service provision agreement. The evidence gathered led to the conclusion that the National School of Judiciary and Public Prosecution was responsible for all operations related to making a copy of the database and transferring it to the target server.
The correctness of the factual findings allows us to move on to assessing the validity of the allegations of violation of substantive law. As part of the first allegation, the National School of Judiciary and Public Prosecution raises a violation of Article 32 paragraphs 1 and 2 in connection with Article 5 paragraph 1 letter f, Article 24 paragraph 1 and Article 25 paragraph 1 of the GDPR due to the incorrect interpretation and assumption that the complainant did not assess the risk of a breach of the principle of confidentiality of personal data resulting from the threat of the possibility of exporting personal data from the system to a publicly available Internet platform in a situation where the content of the order did not include transferring the database using the public Internet, and the provision of services (including transferring the database) was commissioned to an entity that, within the scope of its professional activity, is engaged in performing such activities and demonstrates possession of documents confirming knowledge of the principles and techniques of securing information in IT technologies.
Referring to the objection formulated in this way, it should be recalled that, as part of the objection of incorrect interpretation, the cassation officer should demonstrate and justify that the Provincial Administrative Court incorrectly interpreted the legal norm resulting from the content of the provision of substantive law or incorrectly understood the content of the provision of substantive law. In each of these cases, it is a situation where the interpretation made by the court is unacceptable in the logical and linguistic context, other provisions of law or the purpose for which a given provision was introduced. The objection of violation of substantive law cannot be based on a defective (questioned by the party) finding of fact. This issue is uniformly addressed in the case law of the Supreme Administrative Court (see, for example, the judgment of the Supreme Administrative Court of 11 April 2025, III OSK 555/24). This results in the ineffectiveness of the objection of violation of Article 32 paragraphs 1 and 2 in connection with Article 5 paragraph 1 letter f, Article 24 paragraph 1 and Article 25 sec. 1 of the GDPR, because the Court of First Instance did not violate the cited provisions through their incorrect interpretation.
Similarly, the fourth allegation of violation of substantive law, i.e. art. 28 sec. 3 of the GDPR, is ineffective due to its incorrect interpretation (following the erroneous assessment made by the authority) and the assumption, in the absence of a provision in the agreement between the complainant and the processing entity on the obligation of the processing entity to process data only on the documented order of the controller, that this agreement violates the above provision of law. Art. 28 sec. 3 of the GDPR contains further editorial units (letters). It is up to the author of the cassation appeal to indicate specific provisions of substantive law or provisions of procedure, which in his opinion the Court of First Instance violated, and the Supreme Administrative Court is not entitled to guess the intentions of the author of the cassation appeal and to specify the formulated grounds for cassation.
In turn, the Supreme Administrative Court is to assess the allegation of violation of art. 28 sec. 1 GDPR by improper application and the assumption that the complainant had violated this provision, which requires personal data controllers to use the services of entities processing such that provide sufficient guarantees for the implementation of appropriate technical and organizational measures so that the processing meets the requirements of this Regulation and protects the rights of data subjects, and therefore the Court of First Instance questioned the complainant's choice of the processing entity, in a situation where it was simultaneously recognized that the authority had justifiably discontinued the proceedings also initiated against e. sp. z o.o. due to the lack of any violations of the provisions of the GDPR by that entity.
It follows from the contested decision (its ruling) that the President of the UODO found a violation by the KSSiP not of art. 28 sec. 1, but of art. 28 sec. 3 of the GDPR, this violation occurred by entrusting the processing of personal data to e. Sp. z o.o., in violation of art. 28 sec. 3 GDPR, i.e. without a contractual obligation of the processor to process personal data only upon the documented order of the controller, and without specifying the category of persons in the personal data processing agreement and without clarifying the type of personal data by indicating their category (letter b of the decision of the President of the UODO). At the same time, as it results from the appealed decision, the President of the UODO discontinued the proceedings against the KSSiP regarding the infringement of Art. 28 sec. 1 of the GDPR in the context of the selection of a processor providing sufficient guarantees for data security, and the infringement of Art. 28 sec. 1 of the GDPR did not constitute a basis for the assessment of an administrative fine (p. 21 of the decision of the President of the Personal Data Protection Office of 11 February 2021, no. DKN.5130.2024.2020). The statement contained in the appealed judgment that the KSSiP violated Art. 28 sec. 1 GDPR should be treated solely as a clerical error, as the Court of First Instance does not refer to this provision in the further course of its arguments. Thus, the allegation of infringement of Art. 28 sec. 1 GDPR due to improper application and the assumption that the complainant had infringed this provision is obviously unfounded.
As part of the next objection, the KSSiP claims that the Court of First Instance violated Article 102 paragraph 3 of the Personal Data Protection Act in connection with Article 83 paragraph 2 letters c, e, f and h of the GDPR by incorrectly interpreting and assuming that the authority took into account, when imposing the penalty, mitigating circumstances affecting the penalty in the event of its imposition in the maximum amount permitted by law, i.e. PLN 100,000. In relation to this objection, it should be stated that the authority actually imposed a fine on the complainant in the maximum amount permitted, while at the same time stating in the justification of the decision that it took into account the mitigating circumstances of liability, including the actions taken by the administrator in order to minimize the damage suffered by the data subjects. Informing about the violation led to the deletion of the file with a copy of the database, as well as the deletion of the link leading to the file. Despite this, the President of the UODO found that the mitigating circumstances do not have a direct impact on the amount of the fine imposed due to the fact that KSSiP is a public entity to which Article 102 paragraph 1 point 1 of the UODO applies. In the opinion of the authority, "the maximum fine imposed in this case is disproportionately low in relation to the scale and gravity of the infringement from the perspective of Regulation 2016/679. The reduction of the fine due to the mitigating circumstances was in this case consumed by a circumstance more favourable to KSSiP, which is the statutory limitation of the fine to PLN 100,000" (p. 25 of the contested decision of the President of the UODO). In the opinion of the Supreme Administrative Court in the adjudicating panel, the above finding is correct and the Court of First Instance did not violate Article 102 paragraph 3 of the Personal Data Protection Act in connection with Article 83 paragraph 2 letters c, e, f and h of the GDPR. Article 102 sec. 3 of the Personal Data Protection Act provides that the administrative pecuniary penalties referred to in sec. 1 and 2 shall be imposed by the President of the Office on the basis of and under the conditions specified in Article 83 of the GDPR. The reference to the provisions of the GDPR means that it is necessary for the authority to comply with the requirements of effectiveness, proportionality and the dissuasive nature of sanctions for infringement of the provisions of the GDPR. Article 102 sec. 1 of the Personal Data Protection Act should be interpreted solely as limiting the upper limit of the statutory threat, but not as a directive on the amount of the administrative pecuniary penalty. These have been specified in Article 83 sec. 2 of the GDPR and require that both aggravating and mitigating circumstances of the entity’s liability be taken into account. Moreover, the requirement resulting from Article 83 sec. 1 of the GDPR that pecuniary penalties be effective, proportionate and dissuasive in each individual case is of a supra-statutory nature, and therefore it cannot be limited on the basis of Article 102 sec. 1 u.o.d.o., which only specifies the maximum amount of the administrative fine.
Emphasizing the individual nature of the fine, it should be noted that the occurrence of circumstances mitigating liability will not always result in imposing a penalty below the maximum statutory penalty. The authority rightly noted that in the realities of the case, the statutory limitation of the penalty was a favorable circumstance for the KSSiP, due to the predominant share of circumstances aggravating this entity. Attention should be paid here to the large number of people affected by the violation (50,283), practicing professions and holding positions specified in art. 2 sec. 1 points 2 and 3 of the Act on the National School of Judiciary and Public Prosecution, i.e.: judges, judicial assessors, prosecutors and prosecutor's assessors, court registrars, assistants to judges, assistants to prosecutors, professional probation officers and officials of courts and prosecutors' offices. The authority drew attention to the category of personal data concerned by the breach of personal data protection, i.e. in particular: first name and last name, e-mail address, user name, telephone number, unit, department, unit address, town, and in relation to 44,262 people also PESEL numbers. All these circumstances mean that imposing a penalty of less than PLN 100,000 could not have an effect related to the effectiveness or deterrent nature of the penalty. Thus, the authority correctly indicated in the contested decision that the maximum penalty imposed in this case is still disproportionately low to the scale and gravity of the infringement from the perspective of the provisions of the GDPR.
To sum up, the Court of First Instance was wrongly accused of violating the provisions of substantive law. The Supreme Administrative Court shares the findings made by the President of the UODO and approved by the Court of First Instance, finding that the liability for the breach of personal data protection of persons with an account on the KSSiP training platform lies with the National School of Judiciary and Public Prosecution. In light of Article 32 sec. 1 and 2 of the GDPR, it was this entity, as the controller deciding on the purpose and methods of processing personal data, that was obliged to apply appropriate technical and organizational measures, and the failure to take them into account was related to the lack of verification of the appropriate protection of personal data. KSSiP, by not involving the processing entity in the migration process and not providing full information on the activities undertaken and the expected results, did not ensure that the processed personal data were adequately secured, and therefore liability for the violation of personal data protection was correctly attributed to this entity. Thus, in the appealed judgment, the Voivodship Administrative Court in Warsaw correctly assessed the decision of the President of the Personal Data Protection Office of February 11, 2021, No. DKN.5130.2024.2020 on the imposition of a fine for the violation of personal data protection regulations.
Taking into account the above arguments, the Supreme Administrative Court found that the cassation appeal did not contain justified grounds, therefore, pursuant to Article 184 of the Code of Administrative Procedure, it dismissed it.
The costs of the cassation proceedings from the National School of Judiciary and Public Prosecution to the President of the Office for Data Protection, limited to the remuneration of a legal adviser, were ruled on the basis of Article 204 item 1 of the Code of Administrative Procedure in connection with Article 205 § 2 of the Code of Administrative Procedure.
