Warsaw Administrative Court: Fine for unauthorized address trading overturned

The Provincial Administrative Court in Warsaw, in a judgment dated December 11, 2019 (Ref.: II SA / Wa 1030 / 19), annulled the fine imposed on Bisnode Polska in the amount of EUR 220,000 due to errors in calculation. The violation of the information requirements according to Art. 14 GDPR, on the other hand, was confirmed.

The Bisnode Polska directory assistance distributes digital business information and primarily provides credit reports and other information about companies. The company obtains the respective information from publicly available sources, such as the Central Register and Information on Economic Activity (CEiDG). This constitutes data processing within the meaning of the GDPR, so that there is an obligation to inform the data subjects in accordance with Art. 14 GDPR.

According to the authority, however, in the present case the company notified only about 680,000 of the six million persons affected, of whom an e-mail address was available, by electronic means. The majority of the data subjects whose data was processed remained unaware of this, although the company would have been obliged to provide information in principle in the view of the supervisory authority. However, Bisnode Polska considered it disproportionate to notify the remaining 5.32 million individuals by mail or telephone and therefore only published information on the scope of data processing on its website.

The Polish data protection authority (UODO) had imposed the fine due to non-compliance with the information requirements provided for under Art. 14 GDPR when using data from publicly available sources. The responsible parties had deliberately refrained from the duty to inform and thus deprived the aggrieved parties of the possibility to make use of their rights under the GDPR. Accordingly, they could not object to the further processing of their data or demand its correction or deletion.

Now the Provincial Administrative Court in Warsaw has annulled the fine imposed due to procedural errors. Initially, the necessary evidence for verification was lacking for the determination of the number of affected persons at a level of six million. However, this is decisive, because the amount of the fine is largely determined by the specific number of data records involved. Furthermore, it was erroneous to base the amount of the fine on general, preventive considerations. Article 58 of the GDPR explicitly states that a fine imposed must be related to the specific facts established. Rather, a general deterrent effect is not a suitable legal ground.

In the judgment, the court also answered the question of whether or not Bisnode Polska should have complied with the notification obligation of Article 14 GDPR. According to the Provincial Administrative Court of Warsaw, the high cost of sending the information by mail could not mean that there was a disproportionate effort. In such cases, too, there is therefore in principle an obligation to provide information about data processing. Thus, the court confirmed the assessment of the supervisory authority, according to which Bisnode should have informed the data subjects in accordance with Art. 14 GDPR despite the associated financial expense.

According to the press release of the Polish data protection authority, the ruling is not legally binding. Meanwhile, the Polish data protection authority has already announced the revision of the fine in a new administrative procedure.