The Court for the first time issued a judgment entirely overturning a decision of the Polish Supervisory Authority

The judgment is interesting for several reasons. Firstly, as of today it is one of the few verifications of the position of the Supervisory Authority in the Polish legal system and at the same time it is a legally binding interpretation of the provisions of the GDPR. So far, we could only rely on decisions of the Polish Supervisory Authority itself and specialist literature. (There are, of course, guidelines of EU bodies available).

Secondly, this is another Court judgment that overturns sanctions imposed by the Polish Supervisory Authority and indicates a less restrictive interpretation of the regulations by the Court in relation to the interpretation of the Polish Supervisory Authority.

It should be noted that the judgment is not yet final and the parties have the right to appeal against it to the Supreme Administrative Court.

In 2015, an elementary school implemented a system for collecting students' fingerprints for biometric identification. The identification was introduced for the purpose of serving meals in the school canteen.

The Polish Supervisory Authority, the President of the Personal Data Protection Office, ex officio initiated inspection proceedings, which revealed that:

The school placed a fingerprint reader at the entrance to the canteen. The purpose of the system was to verify the payment for meals. The school indicated consent as the basis for the processing, which was given by a parent in the form of a written statement. The school also explained that it did not have a database that contained fingerprint images, and the data associated with the fingerprint reader were only collected in the reader itself in the form of a byte string record. Access to the data in the data reader was restricted to two individuals authorised by the school. Parents were informed of the option to consent or to refuse to consent to the use of the fingerprint reading system. Upon termination of the school canteen contract, the data were deleted.

The Polish Supervisory Authority ruled that the school violated the provisions of Article 5(1)(c) and Article 9(1) of the GDPR and ordered:

In the Polish legal system, the maximum administrative fine that can be imposed on a public school is PLN 100,000 (EUR 22,500), so the imposed fine should be considered relatively high.

In its decision, the Polish Supervisory Authority indicated mainly that:

The Authority also questioned the consent-based processing of students’ data. According to the definition of consent expressed in Article 4(11) of the GDPR, as well as in Recital 43) of the GDPR Preamble:

The Court overturned the decision of the Polish Supervisory Authority in its entirety.

The Court found that the decision was in material breach of the applicable provisions of both European and national law and questioned the legitimacy of the sanctions such as: (1) ban of processing, (1) ordering data erasure, (3) imposing an administrative monetary penalty.

The qualification of the data as biometric data in accordance with the definition in Article 14(4) of the GDPR was found to be correct.

The legal bases set out in Article 9(2) of the GDPR are self-contained, independent and equivalent, which consequently means that the fulfilment of one of them is sufficient for the admissibility of the processing, and the legislator does not generally differentiate between the bases in terms of their legal significance.

The Court held that the written parental statements in which the parents of the students unambiguously and without any doubt gave their consent to the processing of the data for a specific purpose - proved that the legal basis referred to in Article 9(2)(a) of the GDPR was met.

According to the Court, the principles expressed in Article 5 are binding norms of law, prescribing a particular way of proceeding, with particular relevance for the application and interpretation of data protection law.

The term 'adequate' means 'relevant, compatible, proportionate, not excessive' and can be considered as a synonym for the word 'appropriate'. Adequacy and appropriateness can be understood as the necessity to keep the scope of data in appropriate proportion to the purposes of the processing and to process only those data which are necessary for the achievement of specified purposes. The school proved that in order to respect the principle of minimisation of personal data, it first used the lunch card payment verification system, while the fingerprint reader was not introduced as the first but as a follow-up to the lunch card reader and only when the previously used data verification methods proved not to meet the expectations.

Limiting the data only to the necessary minimum and processing only such data without which the purpose cannot be achieved (this interpretation was presented by the Polish Supervisory Authority) should be regarded as a too broad interpretation. It is permissible to process data which significantly help to achieve the purposes of the processing. In practice it often happens that the purpose may be achieved more easily, quickly and more cost-effectively by using data without which it is impossible to achieve the basic objective. 

The principle of data minimisation should not be applied at the expense of adequacy. In this situation, the Court found that it should be admissible to process data to a slightly larger extent than the minimum necessary, provided that the processed data are closely related to the achievement of the purpose. The school, as the controller of the biometric data, substantiated in the course of the investigation the existence of a legitimate nexus between the purpose of the processing and the scope of the data it plans to process, and explained in a precise manner why the previously used data verification methods proved not to meet expectations.

The Court adopted an interpretation of the principle of data minimisation favourable for the controller, while pointing out that the principle of data minimisation should not take precedence over other principles. Adopting such a restrictive interpretation as the Polish Supervisory Authority has presented in this case would make it impossible in practice to process any data other than those without which the purpose cannot be achieved. The judgment is the first in which such a complete and extensive analysis and interpretation of the application of the basic provisions of the GDPR has been made. The Polish Supervisory Authority did not agree with this interpretation and has already announced an appeal to the Supreme Administrative Court.