Background information

• Date of final decision: 23 June 2025
• National case
• Legal Reference(s): Article 31 (Co-operation with the supervisory authority)
• Decision: administrative fine
• Key words: administrative fine, Cooperation with the supervisory authority

Summary of the Decision

Origin of the case  

The case concerns a complaint to the President of the Personal Data Protection Office lodged by an individual in 2021 about irregularities in the processing of his or her personal data by an entrepreneur from Silesia voivodeship. That was the processing of the complainant’s biometric data by the employer.

Key Findings

In the course of the examination of the case itself, the PL SA found that the entrepreneur, as employer, acted in relation to the complainant as controller and obtained his or her personal data (including possibly fingerprints). PL SA therefore called on the entrepreneur to comment on the content of the complaint and to provide explanations on the legal basis on which it processed (or processes) the biometric data of the complainant; the questions also referred to the duration of the possible processing, the appropriateness of such an action and the obligation to provide information to the data subjects whose data are processed.
The entrepreneur did not provide any explanation in the case. The entrepreneur was also informed that failure to respond fully to the request of the data protection authority may result in the imposition of an administrative fine.
Therefore, the PL SA initiated ex officio proceedings for the imposition of an administrative fine for an infringement of Article 58 (1)(a) and (e) GDPR. The entrepreneur was informed of the opening of the proceedings and was requested to provide the information necessary to determine the amount of the fine. 
However, the entrepreneur did not take any action with regard to the proceedings. The persistent failure of the entrepreneur to reply was considered an obstacle to an objective, thorough and comprehensive examination of the case. Therefore, the PL SA considered that there were grounds justifying the imposition of an administrative fine on the entrepreneur for an infringement consisting in failure to provide information and to provide access to all personal data and information necessary for the performance of its tasks.

Decision

The President of the Personal Data Protection Office has imposed on the entrepreneur an administrative fine of EUR 4 500 for infringement of Article 58 (1)(a,e) GDPR.

For further information: 
•    National press release: Access hindering and failure to provide the President of the PL SA with the necessary information (English)
•    National Decision (Polish)