Bisnode case resolved

After over four years, the first case for the fine imposed by the Polish supervisory authority has finally ended. This much time has lapsed since Bisnode was fined more than 943 thousand zloty for obtaining data from public records without notifying the data subjects. As a consequence, the data subjects did not even know that the Company processed their personal data and, therefore, they could not, among other things, exercise their rights to demand data rectification or object to further processing.

The court also agreed with the President of the Personal Data Protection Office (PDPO) and upheld the appealed judgment of the Provincial Administrative Court according to which the Company should have fulfilled its information obligation towards sole proprietors whose data it had acquired.

The case was controversial right from the outset. Some argued that the PDPO had hit data brokers who dealt with obtaining and processing data for further resale. However, the President of the PDPO never challenged the data acquisition from public records in itself, but after its administrative investigation he concluded that the Company had failed to notify most of the individuals whose data it acquired that it became their data controller and how it wanted to process the data further. It turned out the Company notified only those whose e-mail addresses it had.

The Polish supervisory authority was of the opinion that when acquiring personal data from public records, including the National Court Register, the Central Registration and Information on Businesses or the National Official Register of the National Economy Entities, the Company should have fulfilled its information obligations towards data subjects in accordance with Article 14 of the GDPR by providing the required information directly to them.

The Company appealed the decision to the Provincial Administrative Court in Warsaw, which partially upheld the authority’s position (file no. II SA/Wa 1030/19). However, the PDPO President’s decision concerned not only the above-mentioned individuals but also people who had run sole proprietorships in the past – the court overruled the decision requiring the fulfilment of the information obligation towards that group. Given that the number of people whose rights were violated influenced the amount of fine, the court overruled the decision also in respect of the penalty amount.

Still, the Company lodged a cassation appeal against that ruling pointing out that it wrongly held that the Company had the information obligation because it was entitled to the exemption referred to in Article 14(5)(b) of the GDPR, which says that the controller does not have to comply with the obligation to provide information when this “proves impossible or involves a disproportionate effort”. 

The Supreme Administrative Court dismissed the cassation appeal and upheld the position of the President of PDPO. The court emphasised that the transparency of processing is the GDPR’s overriding principle and any exceptions to this rule, including the exemption from the obligation to provide information due to “disproportionate effort”, should be interpreted restrictively, and should generally be applied to data processing for public purposes, especially for archival, scientific, historical research, or statistical purposes.

The court emphasised that the data in such records are gathered compulsorily, that is, everyone who runs a sole proprietorship must be in the records and must not refuse to provide the data. However, their processing for commercial purposes (not just data browsing) is a different thing altogether and a business must factor in such effort. Therefore, that effort cannot justify the restriction of the individuals’ rights to protect their data (file no. III OSK 2538/21).

Now, the President of the PDPO has to review the case to the extent in which the court has dismissed the administrative decision, i.e. in respect to the data processing of individuals who ran a business in the past and the amount of the administrative fine.

(drafted on the basis of materials available on the website of the Polish Personal Data Protection Office https://uodo.gov.pl/pl)