II SA 3505/01

The Inspector General for Personal Data Protection, hereinafter called the Inspector General, has received information that Powszechny Zakład Ubezpieczeń S.A. (Joint Stock Company), hereinafter called PZU, processed too wide scope of personal data of its clients in connection with concluding contracts on civil liability insurance of possessors of mechanical vehicles. It was said that the company required data on education and marital status, apart from the data necessary to conclude the contract.

Because of the above, the Inspector General ordered PZU to block the processing of data concerning marital status and education of clients. The Inspector General also stated that the processing has to be not only legal but also has to be carried out for specified purposes, adequate and properly secured. Controller may require the data only in a scope which is necessary for realisation of the purpose for which the data are collected. The purpose of data processing should be specified as strictly as possible. The Inspector General pointed out that data on marital status and education are redundant, as they are not used to establish the value of individual insurance rate. This constitutes, therefore, a breach of purpose and adequacy principle.

The Inspector General`s position has been supported by the Supreme Administrative Court, which has dismissed the complaint.