Background information
- Date of final decision: 17 March 2025
- National case
- Legal Reference(s): Article 5 (Principles relating to processing of personal data), Article 6 (Lawfulness of processing), Article 83 (General conditions for imposing administrative fines)
- Decision: administrative fine
- Key words: administrative fine, data subject rights, Principles relating to processing of personal data
Summary of the Decision
Origin of the case
The case concerns an attempt to organise the election of the President of the Republic of Poland only by way of postal voting in spring 2020. At that time, the COVID-19 pandemic was ongoing in Poland. The authorities had started to organise the electoral process in this form, even though the act amending the electoral rules has not yet entered into force. This act, which was not in force in April 2020, assumed that the Polish Post (Poczta Polska) would deliver election packages printed by the Polish Security Printing Works to voters’ mailboxes, and that voters would cast their votes by post so as not to gather in person at polling stations.
On 16 April 2020, the Prime Minister ordered the Polish Post, by an administrative decision, to undertake preparations for the elections of the President of the Republic of Poland by way of postal voting. Referring to this instruction, on 20 April 2020, the Polish Post subsequently made a request to obtain the data of 30 million Polish citizens who were to be of legal age and resided in Poland on the planned election day from the personal identification number (PESEL number) register.
The Minister of Digital Affairs gave his consent and the data delivered (made available) - in the form of a DVD - to the Polish Post on 22 April 2020 and were processed there.
The personal data of around 30 million Polish citizens were destroyed only between 15 and 22 May 2020, after it became clear that the elections on 10 May 2020 would not take place.
Key Findings
In the proceedings, the the Polish SA's President of the Personal Data Protection Office established that, without a legal basis, the Minister of Digital Affairs had provided the Polish Post with the following data: PESEL number, names, surnames, the last current registered address for permanent residence (and if it is missing: the last one, though outdated), address of registration for temporary stay (together with the declared date of this stay) as well as the currently registered temporary departure outside the country.
These data concerned all adult Polish citizens whose country of residence on 10 May 2020 was Poland. After receiving them, the Polish Post processed them without a legal basis.
In its decision, the Polish SA considered that the infringements attributed to the Polish Post were of a serious nature. They are against the basic principles of personal data processing. The Minister of Digital Affairs, being the entity responsible for maintaining and developing the PESEL register – which is the central and most important state collection of personal data of natural persons – should not only have the highest knowledge of the law, but also provide a guarantee of respect for the rights and freedoms of citizens (including those relating to the processing of their personal data included in the register). Meanwhile, in an authoritative and unilateral manner, the Minister decided to make available to the Polish Post the personal data of about 30 million Polish citizens.
Decision
The Polish SA has imposed on the Polish Post a fine of 6 444 174 € for infringement of Article 6(3) of the GDPR in relation to Article 5(1)(a) of the GDPR.
The Polish SA has also imposed an administrative fine of 23 757 € on Minister of Digital Affairs for infringement of Article 6(3) of the GDPR in relation to Article 5(1)(a) of the GDPR. Both fines concern processing personal data of 30 million Polish citizens from the personal identification number (PESEL number) register in relation to the preparations of the elections for President of the Republic of Poland in April and May 2020 by way of postal voting.
For further information:
• Press release: Administrative fines for GDPR infringement during correspondence elections in 2020
• National decision in Polish
The news published here does not constitute official EDPB communication, nor an EDPB endorsement. This news item was originally published by the national supervisory authority and was published here at the request of the SA for information purposes. Any questions regarding this news item should be directed to the supervisory authority concerned.