NSA - III OSK 6781/21
From GDPRhub
| NSA - III OSK 6781/21 | |
|---|---|
 | |
| Court: | NSA (Poland) |
| Jurisdiction: | Poland |
| Relevant Law: | Article 17 GDPR Article 85(1) GDPR Article 2(1) Polish Data Protection Act |
| Decided: | 09.02.2023 |
| Published: | |
| Parties: | |
| National Case Number/Name: | III OSK 6781/21 |
| European Case Law Identifier: | |
| Appeal from: | WSA Warsaw (Poland) II SA/Wa 100/21 |
| Appeal to: | |
| Original Language(s): | Polish |
| Original Source: | NSA (in Polish) |
| Initial Contributor: | kiki |
The Polish Supreme Administrative Court ruled that Article 17 GDPR also applies to archived online publications and that the Polish DPA must consider these requests.
English Summary
Facts
The controller is a publisher who made an online publication containing personal data of the data subject, which could still be found in the websites archives. The data subject requested deletion of this information from the archive based on their right to be forgotten (Article 17 GDPR) but the controller denied the request for undisclosed reasons. Subsequently, the data subject complained to the Polish DPA, claiming that the controller had no legal basis to publish the respective personal data.
Polish law provides exemptions from the applicability of the GDPR for journalistic activity, based on Article 85(2) GDPR. According to Article 2(1) of the Polish Data Protection Act, most of Chapter II and III of the GDPR do not apply to press materials. The DPA argued that the publication was a manifestation of 'journalistic press activity' and therefore did not need a legal basis under the GDPR based on the exception contained in Article 2(1) of the Polish Data Protection Act. Hence, the DPA refused to open administrative proceedings against the controller and rejected the complaint.
The data subject (the plaintiff) complained in national court against the DPA's (the defendant) decision to not initiate proceedings. The dispute essentially concerned two issues. First, whether the maintenance of a particular publication on the publisher's portal - in the archives - constituted 'press activity' which partially excluded the applicability of the GDPR. Second, whether Article 17 GDPR applied also in matters relating to press activity.
With regards to the first issue, the Provincial Administrative Court in Warsaw ruled that any publication, no matter when released, also when containing personal data, is to be considered press material. Concerning the second point, the Court recalled Article 17(3) GDPR, which excludes the application of the right to be forgotten when it is 'necessary' for the exercise of the right to freedom of expression and information. However, Article 2(1) of the Polish Data Protection Act did not exclude the applicability of Article 17 GDPR as such. Therefore, the Court ruled that the defendant should have considered the applicability of Article 17 GDPR and unjustifiably refused to open administrative proceedings against the controller.
The defendant appealed this decision to the Supreme Administrative Court.
Holding
The Supreme Administrative Court (the Court), being the court of last instance, considered the two issues ruled on by the Provincial Administrative Court in Warsaw, the court of first instance.
First, the Court agreed that providing access to an archive publication stored on a website still constitutes journalistic press activity within the meaning of Article 2(1) of the Polish Data Protection Act and national press law. Especially publications made on the Internet are accessible to users, even if archived. The Court ruled that the technical possibilities allowing for rapid acquisition of personal data from press material published on the Internet dictate the limitation of processing time of these publications. The Court held that, in order to maintain the balance between freedom of expression and protection of personal data, in line with Article 85 GDPR, the right to be forgotten must also apply to archived publications on the Internet.
Second, the Court considered whether the court of first instance was correct in ruling that the defendant acted unlawfully by not considering the plaintiff's request for deletion under Article 17 GDPR. The Supreme Administrative Court agreed with the judgement of the court of first instance and held that the defendant should have given more consideration to the balancing of interests under Article 85 GDPR.
In conclusion, the Court dismissed the appeal and upheld the judgement of the Provincial Administrative Court in Warsaw.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Polish original. Please refer to the Polish original for more details.
Date of judgment
2023-02-09 final judgment
Date of receipt
2021-09-28
Court
The Supreme Administrative Court
Judges
Maciej Kobak
Rafał Stasikowski /chair rapporteur/
Zbigniew Slusarczyk
Symbol with a description
647 Matters related to the protection of personal data
Thematic keywords
Personal data protection
Ref. linked
II SA/Wa 100/21 - Judgment of the Provincial Administrative Court in Warsaw of 2021-06-30
The complained authority
Inspector General for Personal Data Protection
Result content
The cassation appeal was dismissed
Referenced regulations
OJ 2020 item 256 art. 61 § 1
Act of June 14, 1960 Code of Administrative Procedure - i.e.
OJ 2018 item 1000 art. 2 sec. 1
Act of 10 May 2018 on the protection of personal data
theses
1. Legal solutions contained in art. 14, 51 and 54 of the Constitution and in Art. 85 of the GDPR require it to be assumed that the priority of freedom of the press over the protection of the right to privacy is only possible until the goals of press activity are met, and thus until the press material, in accordance with Art. 1 of the Press Law Act serves to implement the right of citizens to reliable information, transparency of public life as well as social control and criticism, i.e. until specific information contained in material press material has the attribute of being up-to-date;
2. A contrario, the publisher's sharing of archival publications stored on the website does not constitute press activity consisting in editing, preparing, creating or publishing press materials within the meaning of the Press Law Act, to which, in accordance with the provision of art. 2 sec. 1 of the Act of May 10, 2018 on the protection of personal data, the provisions of art. 5-9, Art. 11, art. 13-16, art. 18-22, art. 27, art. 28 sec. 2-10 and art. 30 GDPR;
3. This means that the provision of Art. 17 of the GDPR regulating the so-called the right to be forgotten, as sharing archival press materials available on the Internet is not necessary to exercise the right to freedom of expression and information, as referred to in Art. 17 sec. 3 letter a of the GDPR, because the right to freedom of expression and information has already been exercised earlier, i.e. at the time of publishing the material having the attribute of news, and thus serving the tasks of the press referred to in art. 1 of the Press Law;
4. The archival press material stored on the website is up-to-date, except for the moment of publication, only for a certain period of time after publication, the length of which depends on the individual circumstances of the case.
Sentence
The Supreme Administrative Court composed of: Chairman: Judge of the Supreme Administrative Court Rafał Stasikowski (judgment) Judges Judge of the Supreme Administrative Court Zbigniew Ślusarczyk Judge del. WSA Maciej Kobak after examining, on February 9, 2023, at a closed session in the General Administrative Chamber, the cassation complaint of the President of the Office for Personal Data Protection against the judgment of the Voivodship Administrative Court in Warsaw of June 30, 2021, file ref. act II SA/Wa 100/21 on the complaint filed by B. against the decision of the President of the Office for Personal Data Protection of November 23, 2020, no. DS.523.5165.2020.PR.EK regarding the refusal to initiate proceedings on the protection of personal data 1. dismisses the cassation appeal; 2. orders the President of the Office for Personal Data Protection to S.B. the amount of PLN 240 (two hundred and forty) as reimbursement of the costs of the cassation proceedings.
Justification
By the judgment of June 30, 2021, file ref. act II SA/Wa 100/21, Provincial Administrative Court in Warsaw, after considering the complaint of the District Court against the decision of the President of the Office for Personal Data Protection of November 23, 2020, no. DS.523.5165.2020.PR.EK, on the refusal to initiate proceedings
on the protection of personal data: 1. repealed the challenged decision;
2. awarded the President of the Personal Data Protection Office to S.B. the amount of PLN 597 as reimbursement of the costs of the proceedings.
The judgment was issued in the following factual and legal situation.
By order of November 23, 2020, the President of the Office for Personal Data Protection, referring to art. 61 § 1 of the Act of 14 June 1960 - Code of Administrative Procedure (Journal of Laws of 2020, item 256, as amended; hereinafter referred to as "KPA), Article 85(1) of the Regulation of the European Parliament and of the Council (EU ) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L. No. 119. p. 1 , as amended; hereinafter referred to as "GDPR"), and Article 2(1) of the Act of May 10, 2018 on the protection of personal data (Journal of Laws of 2019, item 1781; hereinafter referred to as "u.o.d.o") , refused to initiate administrative proceedings against S. B.'s complaint about irregularities in the processing of personal data by A. S.A. (also known as the publisher), in connection with the publication of the complainant's personal data in a press article on the website administered by the company.
In the justification, the authority indicated that, according to the complainant, the publisher processes his personal data through a press publication on the website (he provided the address of the publication) and refuses to remove his personal data from this publication. He also claimed that his personal data is processed on another website (he also provided the address) by a reader named "[...]". The complainant requested that the publisher be ordered to remove his personal data from publications placed on the server [...] and in databases related to them - that is [...].
The President of the UODO cited Art. 7 sec. 2 points 1 of the Act of January 26, 1984 - Press Law (Journal of Laws of 2018, item 1914; hereinafter "Press Law"). He pointed out that the articles published on [...] and [...] correspond to the definition of the press and constitute a manifestation of journalistic press activity. The authority quoted Art. 85 sec. 1 of the GDPR, claiming that the Polish legislator in Art. 2 sec. 1 u.o.d.o. provided for the exclusion of Art. 5-9, Art. 11, art. 13-16, art. 18-22, art. 27, art. 28 sec. 2-10 and art. 30 GDPR
in relation to journalistic activities. He pointed out that the proceedings conducted by the authority serve to control the compliance of data processing with the provisions on the protection of personal data and is aimed at issuing an administrative decision - pursuant to art. 58 sec. 2 GDPR. In the present case, the legality of data processing cannot be assessed based on the premises set out in Art. 6 sec. 1 of the GDPR, due to the exclusion of the application of this provision to journalistic activities. Due to the inability to make a substantive assessment of the disclosure of the complainant's personal data in the article contained on the given website, based on the applicable provisions on the protection of personal data, it is not possible to use the powers allowing to restore the lawful state.
In the light of the circumstances presented by the complainant, the authority refused to initiate the proceedings because, in his opinion, there were no legal grounds
and facts to conduct the proceedings in the presented case.
The complainant lodged a complaint against the above decision to the Voivodeship Administrative Court in Warsaw.
In response to the complaint, the administrative authority requested its dismissal, upholding the existing arguments.
Taking into account the complaint, the Court of First Instance indicated that the authority was rightly accused of violating the provisions of substantive law, which outline the competence of a specialized authority in the field of personal data protection to adjudicate
in cases concerning irregularities in this respect - the President of the Office for Personal Data Protection. This led to the failure to consider the case in its essential aspects.
At the outset, the Court stated that the factual and legal circumstances of the case are not disputable in terms of determining that the complainant demanded the termination of the processing of his personal data on the website, whose administrator was the publisher, as part of the text that was previously a press publication. In fact, the dispute boils down to two issues: whether maintaining a specific publication on the publisher's website - in the archives - constitutes "press activity", against which it is excluded - pursuant to art. 2 sec. 1 u.o.d.o. - part of the GDPR regulation (1); whether the regulation of art. 17 GDPR ("right to be forgotten") (2).
According to this court, the press law does not set time limits in which specific categories of information constituting press materials may be published in the resources of an ICT network, also when they contain personal data.
In practice, it is assumed that each publication can be available indefinitely. In this context, it cannot matter that a given text is archival, even if it was placed in an appropriate separate catalogue. The allegations of the complaint are therefore unfounded in this regard. The authority rightly considered that a given text, containing the complainant's personal data, constituted a published press material - within the meaning of the provisions of the Press Law.
In the opinion of the Court of First Instance, it was correctly stated in the complaint that the national legislator, using the authorization contained in Art. 85 sec. 1 of the GDPR, limited the application of the rules from this regulation to press activities - so art. 2 sec. 1 u.o.d.o.. Specific complexes of GDPR regulations that are not applicable in a given scope are listed there. Articles are not mentioned in this catalogue. 17 of this act. Therefore, from the explicit will of the legislator, the provisions of the GDPR in a given scope - and regarding the right to be forgotten - also apply to press activity referred to in art. 2 sec. 1 u.o.d.o.. This court emphasized that special provisions, including general rules - such is undoubtedly Art. 2 sec. 1 u.o.d.o. - they cannot be interpreted broadly, which was done by the administration body.
According to this Court, analyzing the meaning of Art. 17 sec. 3 lit. a of the GDPR, however, it cannot be overlooked that the EU legislator excluded the application of the general rules of the right to be forgotten only when it is "necessary" to exercise the right to freedom of expression and information (yes, section 3, introductory sentence), and not generally - in the scope of right to freedom of expression or information. Therefore, it is justified to conclude that the right to be forgotten applies to, for example, cases where certain personal data are no longer necessary for the purpose for which they were collected or otherwise processed - pursuant to art. 17 sec. 1 lit. a GDPR - and are not necessary at the same time
from the perspective of the freedom to exercise the right to freedom of expression and information, within the meaning of para. 3 lit. and the indicated act.
In the opinion of the Voivodship Administrative Court, in view of the specific request of the complainant, first addressed to the data controller (publisher), but not taken into account by him, the role of the specialized body examining the complaint was to consider whether, from the perspective of freedom of access to information, further processing of the complainant's personal data in the press material from several years ago is in fact essential. In the context of the allegation of maintaining the availability of press material for an excessively long time, it also required clarification whether the actual practice of a given publisher is to publish all materials for a long or even indefinite period, or whether their periodic selection is actually carried out. In the latter case, maintaining a specific publication - e.g. containing critical statements towards a specific person - may not serve the purpose of providing objective press information (current or archival), but e.g. creating the image of specific figures in accordance with the criteria adopted by the administrator for the selection of press materials posted on the Internet. This is not necessary in the context of exercising the right to freedom of expression
and information within the limits of press activity, within the meaning of Art. 2 sec. 1 of the u.o.d.o., and may affect the right to privacy of persons.
In the opinion of the Court of First Instance, taking into account the content of Art. 17 of the GDPR, the authority failed to comply with the provisions of procedural law with regard to the obligation to properly explain the case in its essential aspects, which it would have to express in the justification of the contested act - so in Art. 7, 77 § 1 art. 80 and 107 § 3 in connection with art. 8 § 1 and art. 11 of the Code of Administrative Procedure. Violation of the indicated provisions could have had a significant impact on the outcome of the case. As a result, it was not recognized to a significant extent. The reason for this was an erroneous interpretation of the provision of substantive law, which defines the scope of competence of a given authority - Art. 2 sec. 1 u.o.d.o., therefore art. 17 GDPR. In the opinion of the Court, it was also correctly noted in the complaint that the initiation of proceedings was unreasonably refused, pursuant to Art. 61a § 1 k.p.a.
For the reasons mentioned above, pursuant to Art. 145 § 1 point 1 lit. a and c of the Act of August 30, 2002. Law on proceedings before administrative courts (Journal of Laws of 2022, item 329, as amended; hereinafter referred to as: "p.p.s.a."), the court of first instance revoked the challenged decision. He ruled on the reimbursement of the costs of the proceedings pursuant to Art. 200 in relation to joke. 205 § 2 p.p.s.a. Reconsidering the case, the administration body was obliged to take into account the legal assessment formulated
in the justification.
A cassation appeal against the above judgment was brought by the body represented by the legal adviser, appealing against the judgment in its entirety. He requested that the contested judgment be set aside in its entirety and that the case be remitted in its entirety to the Court of first instance and that the costs of the proceedings be awarded. He also waived the trial. In the judgment under appeal, he alleged:
I. violation of procedural law, i.e.:
1) art. 145 § 1 point 1 lit. c p.p.s.a. in relation to joke. 7, art. 77 § 1, art. 80, art. 107 § 3 in connection with joke. 8 § 1 and art. 11 k.p.a. by erroneously recognizing that the President of the Office for Personal Data Protection did not explain the case in its essential aspects, while the supervisory authority conducted the proceedings respecting the above-mentioned provisions of the Code of Administrative Procedure, and the decision issued by the supervisory authority contained exhaustive justification regarding all factual and legal circumstances of the case under consideration, which had a significant impact on the outcome of the case and resulted in the annulment of the challenged decision of the authority;
2) art. 145 § 1 point 1 lit. c p.p.s.a. in relation to joke. 61a § 1 k.p.a. by recognizing that there were no grounds for refusing to initiate proceedings in the case, while one of the grounds for refusing to initiate proceedings is a situation where the proceedings cannot be initiated for other justified reasons, and such a situation occurred in the case;
II. violation of the provisions of substantive law, i.e.:
1) art. 17 sec. 1-3 GDPR in connection with Art. 2 sec. 1 u.o.d.o. through their erroneous interpretation consisting in the assumption that the legislator's exclusion of the application of Art. 5-9 of the GDPR to press activities does not prevent the application of art. 17 GDPR to press activities;
2) art. 17 sec. 3 lit. a of the GDPR through its incorrect interpretation and acceptance that the President of the Office for Personal Data Protection was entitled to assess the necessity of processing personal data in this case, while the possibility of making the above assessment was excluded from art. 2 sec. 1 u.o.d.o.
In justification, the authority referred to the above allegations.
In response to the cassation appeal, the applicant moved to dismiss it and
to order him to pay the costs of the proceedings. He did not request a hearing.
In this situation, the case was considered at a closed session pursuant to Art. 182 § 2 and 3 p.s.a.
The Supreme Administrative Court considered the following
According to Art. 183 § 1 P.A.S.A, the Supreme Administrative Court hears the case within the limits of the cassation appeal, however, ex officio considers the invalidity of the proceedings. In the case, there are no enumeratively enumerated in art. 183 § 2 p.p.s.a. grounds for the invalidity of administrative court proceedings.
For this reason, when examining the case, the Supreme Administrative Court was bound by the limits of the cassation appeal.
The cassation appeal is inadmissible.
The cassation appeal was based on both grounds referred to in Art. 174 points 1 and 2 of the p.s.a. In such a case, the principle is that allegations of violation of procedural law are examined in the first place, because the assessment of the legitimacy of the allegation of violation of substantive law can be made only on the basis of the facts established by the administrative authority in the case, and not on the basis of the facts that the complainant recognizes as incorrect (cf. judgments of the Supreme Administrative Court: of August 13, 2013, II GSK 717/12; of July 4, 2013, I GSK 934/12; CBOSA). In the present case, however, this order must be reversed, as the allegations of violation of procedural law were formulated in the cassation appeal in such a way that their justification or unfoundedness will be a consequence of the legitimacy or unfoundedness of the allegations of infringement of substantive law.
The essence of the case in question outlined in the cassation complaint are the following three equally important issues: first, whether the President of the Office for Personal Data Protection had a legal basis to adjudicate on irregularities in the processing of the complainant's personal data by A. S.A. in connection with the publication of the complainant's personal data in a press article on the website hosted on the server [...] and in databases related to them, assuming that some time has passed since the first publication of the press material, and the press article is currently hosted on the portal publishers in archival resources; secondly, does providing access to an archival publication stored on a website constitute an activity consisting in editing, preparing, creating or publishing press materials within the meaning of the Press Law (press activity), which, in accordance with Art. 2 sec. 1 u.o.d.o. the provisions of Art. 5-9, Art. 11, art. 13-16, art. 18-22, art. 27, art. 28 sec. 2-10 and art. 30 GDPR; thirdly, whether the provisions of Art. 17 of the GDPR regulating the so-called the law of oblivion.
The GDPR is a comprehensive regulation on the protection of personal data that does not require implementation by national law in order to be applied in a given country. According to Art. 85 sec. 1 of the GDPR, Member States adopt provisions that reconcile the right to the protection of personal data under the GDPR with the freedom of expression and information, including processing for journalistic purposes and for the purposes of academic, artistic or literary expression. Recital 153 of the GDPR explains that the law of the Member States should reconcile the provisions governing freedom of expression and information, including journalistic, academic, artistic or literary expression, with the right to the protection of personal data under the Regulation. The processing of personal data solely for journalistic purposes or for the purposes of academic, artistic or literary expression should be subject to exceptions or derogations from certain provisions of the Regulation where this is necessary to reconcile the right to the protection of personal data with the right to freedom of expression and information provided for in Art. 11 of the Charter of Fundamental Rights of the European Union of 7 December 2000 (Official Journal of the EU of 2016, C 202, p. 1). This should apply in particular to the processing of personal data in the audiovisual field and in press archives and libraries. Member States should therefore adopt legal acts providing for the derogations and exceptions necessary to ensure a balance between these fundamental rights.
Therefore, the GDPR regulation itself noted that there is an inevitable conflict between the right to the protection of personal data and the freedom of expression and information as part of journalistic, academic and artistic activities, manifested in the fact that the enforcement of personal data protection requirements significantly limits the possibility of free data processing, and the collection and dissemination of information may violate data protection laws. This entails the need to reconcile these two rights and freedoms so as to enable their coexistence. Recognizing this problem, the EU legislator authorized in Art. 85 sec. 1 of the GDPR, Member States to adopt specific provisions in this regard and introduce restrictions on data protection to ensure freedom of expression and freedom of information (cf. P. Fajgielski, Commentary to Regulation No. 2016/679 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (in:) General Data Protection Regulation. Personal Data Protection Act. Commentary, WKP 2018).
In Art. 85 sec. 2 of the GDPR indicates that for processing for journalistic purposes or for the purposes of academic, artistic or literary expression, Member States shall determine derogations or exceptions from chapter II (Principles), chapter III (Rights of the data subject), chapter IV (Administrator and processor ), Chapter V (Transfers of personal data to third countries or international organisations), Chapter VI (Independent supervisory authorities), Chapter VII (Cooperation and consistency) and Chapter IX (Specific situations related to data processing), if they are necessary to reconcile the right to the protection of personal data with freedom of expression and information. However, it should be emphasized that the possibility of applying the GDPR has not been completely excluded (issues regarding the scope of its application are included in Chapter I, which was not indicated among the provisions that can be excluded or limited), but only the possibility of introducing exclusions or limiting the application of specific provisions. Thus, the EU legislator decided that a journalist should be exempt from certain data protection requirements when collecting and using personal data, as the need to meet the requirements could significantly limit the freedom to pursue the profession and carry out the mission related to it, and thus the freedom of the press. It should only be added that the concept of journalistic needs should be related to the press in the broad sense of the word, as the traditional press (magazines), but also radio, television and other electronic media, including Internet portals, in accordance with the provisions of the press law.
The national legislator used the option provided for in Art. 85 GDPR
and excluded the application of part of the provisions of this EU regulation in the field of journalistic, literary, artistic and academic expression in art. 2 sec. 1 u.o.d.o. Pursuant to this provision, activities consisting in editing, preparing, creating or publishing press materials within the meaning of the Press Law, as well as statements within the framework of literary or artistic activity, shall not be subject to the provisions of art. 5-9, Art. 11, art. 13-16, art. 18-22, art. 27, art. 28 sec. 2-10 and art. 30 of Regulation 2016/679 (GDPR).
As a consequence, in the light of Art. 2 sec. 1 u.o.d.o. (the so-called press clause), exclusions regarding press activity and literary and artistic expression include the following provisions of the EU regulation: Art. 5 - rules regarding the processing of personal data; article 6 - the grounds for admissibility of personal data processing; article 7 - conditions for expressing consent by the data subject; article 8 - conditions for the consent of the child in the case of information society services; article 9 - processing of special categories of personal data; article 11 - processing not requiring identification; article 14 - information provided in the case of obtaining personal data in a manner other than from the data subject; article 15 sec. 1 and 2 - the right of access of the data subject; article 16 - the right to rectify data; article 18 - the right to limit processing; article 19 - the obligation to notify the recipient of the data about the rectification or deletion of personal data or the restriction of processing; article 20 - the right to data portability; article 21 - right to object; article 22 - automated decision-making in individual cases, including profiling; article 27 - representatives of controllers or processors not established in the Union; article 28 sec. 2-10 - obligations of the processor; article 30 - recording processing activities.
The Polish legislator, fulfilling the obligation based on Recital 153 of the Preamble and Art. 85 of the GDPR, indicated in art. 2 sec. 1 u.o.d.o., that journalistic activity consisting in editing, preparing, creating or publishing press materials, within the meaning of the Press Law, does not apply to a significant part of the obligations provided for in the GDPR. In the name of constitutional freedoms and social good - the general principles of personal data protection have been excluded, such as the principle of lawfulness, transparency and reliability, the principle of limiting the purpose of data processing, data minimization, correctness, limitation of storage, integrity and confidentiality and accountability.
However, as rightly pointed out by the Court of First Instance, indicated in detail in art. 2 sec. 1 u.o.d.o. the provisions of the GDPR do not cover art. 17 of the GDPR, which provides for the right to delete data (the so-called "right to be forgotten"). According to the wording of art. 17 sec. 1 of the GDPR, the data subject has the right to request the administrator to immediately delete personal data concerning him, and the administrator is obliged to delete personal data without undue delay if one of the circumstances referred to in this provision occurs (see: cases listed in detail in Article 17(1)(a) to (f). It should be added that recital 65 of the GDPR states that every natural person should have the right to rectification of personal data concerning him or her and the right to "be forgotten" if the retention of such data violates the GDPR, Union law or the law of the Member State to which the controller is subject. In particular, the data subject should have the right to have his or her personal data erased and no longer processed if the data are no longer necessary for the purposes for which they were collected or otherwise processed, if the data subject concern, withdrew consent or if she objected to the processing of personal data concerning her, or if the processing of her personal data is not
otherwise comply with this Regulation. This right is relevant in cases where the data subject gave consent as a child, when he or she was not fully aware of the risks involved in the processing, and later wishes to delete such personal data, in particular from the Internet. The data subject should be able to exercise this right even though he is no longer a child. However, further retention of personal data should be considered lawful if it is necessary to exercise freedom of expression and information, to comply with a legal obligation, to perform a task carried out in the public interest or in the exercise of official authority vested in the controller, due to considerations of public interest in the field of public health, for archival purposes in the public interest, for scientific or historical research purposes or for statistical purposes, or to establish, pursue or defend claims.
Out of the 6 conditions listed in Art. 17 sec. 1 GDPR, and this is:
a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
b) the data subject has withdrawn the consent on which the processing is based in accordance with art. 6 sec. 1 lit. a) or Art. 9 sec. 2 lit. a), and there is no other legal basis for processing;
c) the data subject raises an objection pursuant to Art. 21 sec. 1 to the processing and there are no overriding legitimate grounds for processing, or the data subject raises an objection pursuant to Art. 21 sec. 2 against processing;
d) personal data has been processed unlawfully;
(e) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
f) personal data has been collected in connection with the offering of information society services referred to in art. 8 sec. 1,
due to the press clause and the lack of the need for the press to prove the basis for data processing, three of them may apply (points a, d and e).
Moreover, it should be added that pursuant to Art. 17 sec. 3 of the GDPR, the above-mentioned right to immediately delete personal data (Article 17(1)) may be used by a person, provided that none of the prerequisites indicated therein occur, and in particular if their processing is necessary to exercise the right to freedom of expression and information. As a consequence, it is assumed that the occurrence of at least one of the circumstances indicated in Art. 17 sec. 3 GDPR means that the administrator is not obliged to delete the processed data, even if the data subject requests it.
The Supreme Administrative Court shares the position of the Court of First Instance that the EU legislator in Art. 17 sec. 3 lit. a of the GDPR excluded the application of the general rules of the right to be forgotten only when it is "necessary" to exercise the right to freedom of expression and information (yes, section 3, introductory sentence), and not generally - in terms of the right to freedom of expression or information. Therefore, it is justified to conclude that the right to be forgotten applies, for example, to cases where certain personal data are no longer necessary for the purpose for which they were collected or otherwise processed - pursuant to art. 17 sec. 1 lit. a GDPR - and are not necessary from the perspective of the freedom to exercise the right to freedom of expression
and information within the meaning of art. 17 sec. 3 lit. and the above act.
In fact, the point here is to decide whether making available an archival publication stored on a website still constitutes press activity (i.e. consisting in editing, preparing, creating or publishing press materials within the meaning of the Press Law). Posing this issue is a consequence of civilization progress. Originally, press activity and the related freedom of the press were carried out by publishing press materials in paper form. In such a situation, there were no automatic instruments for searching and collecting personal data. Press materials published on paper may therefore be available in an unchanged form, i.e. e.g. contain data about persons for an indefinite period, because without additional activity (related to their development and creation of new databases, which, it is worth emphasizing, can currently be created almost exclusively using devices such as computers and software, and thus at least partially in an automated manner) it is not possible to easily and quickly obtain information about individual persons from them. The publication of personal data in paper form as part of press activities is therefore unlimited in time, but accessing them many years after publication is very difficult.
A fundamental change in the availability and collection of data on natural persons has been brought about by technical progress. This was pointed out by the EU legislator in recital 6 of the GDPR, according to which rapid technical progress and globalization have brought new challenges in the field of personal data protection. The scale of collecting and exchanging personal data has increased significantly. Thanks to technology, both private companies and public authorities can use personal data on an unprecedented scale in their activities. Individuals are increasingly sharing personal information publicly and globally. Technology has changed the economy and social life and should continue to facilitate the free flow of personal data within the Union and their transfer to third countries and international organisations, while ensuring a high level of protection of personal data. In turn, Recital 7 of the GDPR states that these changes require a stable, more coherent data protection framework in the Union and its strong enforcement, as it is important to build trust that will allow the digital economy to develop in the internal market. Individuals should be in control of their own personal data. Individuals, economic operators and public authorities should gain a greater sense of legal certainty and its application in practice. Recital 66 of the GDPR also draws attention to being forgotten on the Internet, extending this right not only to the data controller who has made personal data public.
In the conclusion of the above considerations, it should be pointed out that pursuant to Art. 17 sec. 1 lit. a of the GDPR, the right to be forgotten includes cases when certain personal data are no longer necessary for the purpose for which they were collected or otherwise processed, and at the same time they are not necessary to ensure freedom of expression and information, within the meaning of art. 17 sec. 3 lit. and the GDPR.
In connection with technological progress in art. 2 sec. 1 of the GDPR, it was assumed that this regulation applies to the processing of personal data wholly or partly by automatic means and to the processing other than by automated means of personal data that are part of a filing system or intended to form part of a filing system. It follows from this provision that data processing that is not automated (manually) and the processed data does not constitute (or is not intended to constitute) a collection, is not covered by the scope of the GDPR, and therefore in this case the commented regulation does not apply. This, in turn, means that the obligation to apply the commented regulation is related not only to data processing, but also to the occurrence of one of the two conditions indicated in the commented provision: 1) the processing of personal data is fully or partially automated, or 2) the processing takes place other than by automated means and the personal data are or are intended to be part of a data filing system.
Therefore, in order to assess whether the commented regulation is applicable, it is not enough to determine whether data processing takes place, but it is also necessary to assess whether the processing is automated. The processing of personal data is automated when operations on personal data are performed using devices (usually IT systems, computers, servers and accompanying software) that allow for automatic operation (i.e. perform certain activities automatically without the need for any human activity). ). Personal data processing processes are most often carried out using IT systems that allow to automate activities, improve the efficiency of processing while increasing the speed and reducing the costs of performing such activities.
Conducting today's press activity in a traditional way (i.e. by publishing paper texts) together with the publication of press materials on the Internet or conducting press activity only on the Internet, as well as the functioning of technical possibilities allowing for the quick acquisition of personal data from press materials published on the Internet, requires the limitation of the time of processing personal data in press materials available on the Internet. This is because there is a case of conflict of the right to privacy guaranteed by Art. 51 of the Constitution of the Republic of Poland with the right to freedom of expression and access to information guaranteed in the provisions of Art. 14 and 54 of the Constitution of the Republic of Poland.
According to Art. 14 of the Constitution, the Republic of Poland ensures freedom of the press and other means of social communication. In Art. 54 of the Constitution regulates the guarantees for freedom of expression by indicating that everyone is guaranteed the freedom to express their views and to obtain and disseminate information (paragraph 1) and the prohibition of preventive censorship of the means of social communication and licensing of the press with an exception only for the admissibility of the statutory introduction of the obligation to obtain prior license to operate a radio or television station (section 2). At the same time, the freedom to obtain and disseminate information includes the collection and dissemination of data (including personal data) from any sphere of life about any entities by any legally permissible means. In turn, Art. 51 of the Constitution of the Republic of Poland ensures the protection of information concerning a person. The conflict of these provisions is therefore obvious.
Legal solutions contained in art. 14, 51 and 54 of the Constitution and in Art. 85 of the GDPR require it to be assumed that the priority of freedom of the press over the protection of the right to privacy is only possible until the goals of press activity are met, and thus until the press material, in accordance with Art. 1 of the Press Law Act serves the implementation of citizens' right to reliable information, transparency of public life as well as social control and criticism, i.e. until a specific information contained in material press material has the attribute of being up-to-date. One should agree with the Court of First Instance that specific information has the value of being up-to-date if it describes current phenomena, or their specific assessments, or constitutes an analysis of past events (journalism), i.e. only for a certain period of time. Information published in the past may in fact be interesting also after a significant period of time - for the assessment of occurring phenomena, changes in positions, reconstructing old press reports as to the course of events, or simply - collecting data about specific people. In this regard, the provision of press materials on the Internet - which, in the face of available search tools, constitutes a database of personal data - is not one of the tasks of the press explicitly listed by law - it goes beyond providing current information about events or presenting their assessments by specific persons. A contrario, making available by the publisher of an archival publication stored on the website does not constitute press activity consisting in editing, preparing, creating or publishing press materials within the meaning of the Press Law, to which, in accordance with the provision of Art. 2 sec. 1 u.o.d.o. the provisions of Art. 5-9, Art. 11, art. 13-16, art. 18-22, art. 27, art. 28 sec. 2-10 and art. 30 GDPR. This means that the provision of art. 17 of the GDPR regulating the so-called the right to be forgotten, as sharing archival press materials available on the Internet is not necessary to exercise the right to freedom of expression and information, as referred to in Art. 17 sec. 3 lit. a of the GDPR, because the right to freedom of expression and information has already been exercised earlier, i.e. at the time of publishing the material having the attribute of news, and thus serving the tasks of the press referred to in art. 1 of the Press Law. Archival press material stored on the website is up-to-date, except for the moment of publication, only for a certain period after publication, the length of which depends on the individual circumstances of a given case. However, this period cannot be too long, because the exercise of freedom of expression opens the time for updating the constitutional right to privacy protection.
For these reasons, the allegations of infringement of substantive law do not deserve recognition. One should agree with the Court of First Instance that in such a situation the role of the body examining the complaint was to consider whether - from the perspective of freedom of access to information - further processing of the complainant's personal data in the press material from several years ago is in fact necessary. In the context of the allegation of maintaining the availability of press material for an excessively long time, it also required clarification whether the actual practice of a given publisher is to publish all materials for a long or even indefinite period, or whether their periodic selection is actually carried out. In the latter case, maintaining a specific publication - e.g. containing critical statements towards a specific person - may not serve to provide objective press information (current or archival), but, for example, to create the image of specific people, according to the criteria adopted by the administrator for the selection of materials posted on the Internet press releases. This is not necessary in the context of exercising the right to freedom of expression and information within the limits of press activity, within the meaning of Art. 2 sec. 1 of the u.o.d.o., and may affect the right to privacy of persons.
The view should also be shared that the authority, failing to meet the obligation to consider the case in the aspects indicated earlier in relation to the content of Art. 17 of the GDPR, violated the provisions of procedural law in terms of the obligation to properly explain the case in its essential aspects, which he would have to express
in the justification of the contested act - Art. 7, 77 § 1 art. 80 and 107 § 3 in connection with art. 8 § 1 and art. 11 k.p.a. A breach of these provisions could have had a significant impact on the outcome of the case. As a result, it was not recognized to a significant extent. The reason for this was an erroneous interpretation of the provision of substantive law defining the scope of the case. Thus, the Court of First Instance rightly found that in this case, the initiation of proceedings was unreasonably refused, pursuant to Art. 61a § 1 k.p.a. For these reasons, the allegations of violation of procedural law are groundless.
For the above reasons, the Supreme Administrative Court found the cassation appeal to be devoid of justified grounds, which resulted in its dismissal pursuant to Art. 184 p.p.s.a.
The decision on the costs of the cassation proceedings was issued on the basis of Art. 204 point 2 p.p.s.a.
