II SA 1563/03


14 March 2004

The Inspector General for the Protection of Personal Data considered Mr X`s complaint about illegal (in his opinion) processing of his personal data by the Partners of Z Registered Partnership (the Registered Partnership is a vindication company), who obtained his personal data from Y Joint Stock Company (Mr X was a customer of this company) on the basis of a contract of assignment of claims concluded between these entities. The Inspector General for the Protection of Personal Data ordered the Partners of Z Registered Partnership, by means of an administrative decision, to erase Mr X`s personal data collected without his consent from Y Joint Stock Company, in connection with the conclusion of the contract of assignment of claims. For the transfer of data was carried on without Mr X`s consent, which, pursuant to the provisions of the civil law, in case of the contract concluded with the consumer, shall be expressed in its contents. In the opinion of the Inspector General for the Protection of Personal Data, the transfer of data without such consent flagrantly violates the interests of Mr X as a consumer.

Simultaneously, the Inspector General for the Protection of Personal Data ordered Y Joint Stock Company, by means of an administrative decision, not to disclose the Complainant`s personal data without fulfilling the requirements specified in the provisions of the civil law, that is without his consent

In the motion for reconsidering the case the Complainants claimed that the Inspector General for the Protection of Personal Data had incorrectly identified the addressees of the decision (addressing the decision to Partners and not to the Partnership) and wrongly interpreted the provisions of the Civil Code.

The Inspector General upheld the previous decision as valid, and the Partners of the Partnership appealed against the decision to the Supreme Administrative Court, repeating the objections presented in the motion for reconsidering the case, and additionally indicating that the Inspector General for the Protection of Personal Data had not considered the possibility of transferring data on the basis of Art. 23 paragraph 1 point 5 of the Act on the Protection of Personal Data, which allows for the processing of data if it is necessary for the purpose of the legitimate interests pursued by the controllers. The Inspector General for the Protection of Personal Data requested the complaint to be dismissed.

Considering the main contents of the case, the Voivodeship Adminsitrative Court stated that:

The Court did not agree with the objection as to addressing the decision to a person not being a party, as the proceedings is conducted by the Inspector General for the Protection of Personal Data pursuant to the Code of Administrative Procedure, according to which natural and legal persons may be parties to administrative proceedings, and in case of state and self-government organisational units and social organisations - also units without legal personality may be such parties. Art. 18 paragraph 1 of the Act on the Protection of Personal Data in connection with Art. 7 point 4 of this Act provide that the Inspector General for the Protection of Personal Data addresses decisions to the controller, and indicate that an individual or an organisational unit without legal personality may be the controller. Therefore, in case of commercial partnerships without legal personality they can be represented by their partners.

As regards the legal basis for the transfer of personal data obtained as result of the contract of assignment of claims, the Court stated that the provisions of the Civil Code can not constitute the only basis for personal data processing, as they determine the assignment of claims and not the transfer of personal data. Whereas Art. 23 paragraph 1 point 2 of the Act on the Protection of Personal Data requires that the legal provision includes clear authorisation to personal data processing. While considering the condition referred to in Art. 23 paragraph 1 point 5 of the Act, the Court stated that in the light of this provision it is important to find out whether the situation of the data subject has not worsened. Upon considering the case the Voivodeship Administrative Court took into account all the provisions of both the administrative and the civil law. While evaluating the legal situation of the contracting party to the consumer contract, the Court assumed that in order to state that the transfer of data does not violate the consumer`s interests his/her consent to the processing of data would have to be expressed directly in the contents of the contract concluded with the consumer.

In consequence, the Voivodeship Administrative Court stated that the decision of the Inspector General for the Protection of Personal Data does not violate the law.