The Office of Personal Data Protection has concluded many years of proceedings. There are 100 thousand PLN fine for the minister

The President of the Personal Data Protection Office imposed an administrative fine of PLN 100,000. PLN for the Minister of Justice. The decision was made after the end of the proceedings regarding the case described in media reports as the 2019 hate scandal.

According to the findings of the supervisory authority, the judges’ personal data were obtained by persons who then independently decided on the purposes and methods of their processing, despite the lack of appropriate authorization from the administrator. The proceedings also showed that the controller had not implemented appropriate technical and organizational measures to prevent unlawful data processing.

Penalty for the Minister of Justice. What did the Personal Data Protection Office establish?

The case was initiated in 2019 after media publications describing the acquisition of information about judges critical of changes in the justice system. The materials indicated that the obtained data was then used to publish content insulting judges.

At the beginning of the proceedings, the then Minister of Justice announced that no incident involving the leakage of personal data had been detected. Criminal proceedings were conducted in parallel, but for many years the President of the Personal Data Protection Office did not receive detailed information for the sake of the investigation. Only in December 2024 did the Regional Prosecutor’s Office in Wrocław provide evidence that allowed the administrative proceedings to be completed.

The Personal Data Protection Office pointed to the lack of appropriate supervision

The provided materials showed that persons authorized to access judges’ personal files used the information obtained for private and political purposes. The data was transferred to unauthorized persons, including other public officials and journalists, and some information was also published on the Internet.

The President of the Personal Data Protection Office emphasized that the administrative proceedings concerned the liability of the data controller, i.e. the Minister of Justice, and not of the persons who were directly responsible for the illegal disclosure of information. In the opinion of the authority, the administrator should ensure appropriate supervision over the data processing process and control over the manner of using the granted authorizations.

Why was the penalty imposed?

The authority found that the violations were serious and concerned the basic principles of personal data protection under the GDPR. It was also pointed out that it was particularly important that the data controller was a constitutional body of the state, which is expected to comply with the highest standards of law.

The President of the Personal Data Protection Office also emphasized that the decision does not exclude the liability of persons who directly processed data unlawfully. However, the administrative penalty could only be imposed on the data controller. The authority also indicated that the administrator may pursue liability towards persons authorized to process data under other legal provisions.