Polish SA: administrative fine of 17 880 € for Commander-in-Chief of the Polish Police for disclosing data of a citizen at a press conference

Background information

• Date of final decision: 19 March 2025
• National case
• Legal Reference (s): Article 6 (Lawfulness of processing), Article 9 (Processing of special categories of personal data),  Article 24 (Responsibility of the controller)
• Decision: administrative fine
• Key words: administrative fine, sensitive data, data security, lawfulness of processing,  data subject rights

Summary of the Decision

Origin of the case  

The case concerns an incident from 2023. Media revealed at that time that a woman who had been in contact with the 112 emergency telephone number and reported that she had psychological difficulties and had previously terminated her pregnancy by pharmacological means, ended up in the hospital, where police officers soon appeared. The media named the woman and the city where the incident occurred. She appeared in front of cameras, revealing her image.

At that time, the then Commander-in-Chief of the Police convened a press conference and disclosed information about the woman’s health and other data about her, without having any basis for doing so. The Commander-in-Chief disclosed them in a specific context – when the public was aware of her data and the case. The information provided by him could therefore be linked to a specific person. He also provided data which she had not previously disclosed, such as information on psychiatric treatment, as well as information on the end of her relationship, the place of residence, type of home and the legal title to the premises. The woman filed a complaint to the President of the Polish Supervisory Authority (SA).

Key Findings

The President of the Polish SA, Mirosław Wróblewski, examined the case and found that the provisions of the GDPR had been infringed (Article 6(1) and 9(1)). 

The Polish DPA concludes that this infringement of the GDPR is of a serious nature. The personal data of the person to whom the police were supposed to provide assistance was made available to the public without a legal basis. The Commander-in-Chief of the Police, as the public authority, competent for the protection of human security and the maintenance of public security and public order, at the head of the institution intended to carry out these tasks, is the body which should pay particular attention to the welfare of such persons and the security of their personal data.

Making the data available by the Commander-in-Chief in breach of the GDPR (without a legal basis) during the conference entails not only a potential but also a real possibility for third parties to use the data without the knowledge and consent of the data subject, and therefore entails a risk of damage, in particular in the form of discrimination, loss of reputation and loss of control over his/her own data.

Moreover, the information disclosed at the conference was not, as the Commander-in-Chief of the Police explained, ‘press material’. The press conference is not an activity of the Commander-in-Chief, which consists ‘in the drafting, preparation, production or publication of press material’, so that the Commander-in-Chief of the Police could not defend himself that the information disclosed at the conference constituted press material within the meaning of the press law which had been made available in the course of the press activity of the Police under the press law, which precludes the application of Articles 5 to 9 of the GDPR to that material.

Decision

The President of the Polish SA has imposed on the Commander-in-Chief of the Police an administrative fine of 17 880 € for infringement of Articles 6(1) and 9(1) of the GDPR.

For further information: 

• Press release: Administrative fine for the Commander-in-Chief of the Polish police
• National decision (Polish)