Entrepreneurs often inform about the GDPR in terms of how convenient it is for them, citing a provision that relieves the obligation to provide information if such information would require disproportionate effort. In the case described below, it can be seen that the deliberate failure to comply with the obligation to provide information, on a large scale, may entail very high fines.
Judgment of[11] December 2019 Provincial Administrative Court on the signature of Act II SA/Wa 1030/19 on the processing of personal data, he partially dismissed Bisnode’s complaint, considering that an entrepreneur engaged in an economic activity consisting in obtaining personal data from publicly accessible public registers and their subsequent analysis and making available to individual entities for commercial purposes is obliged to comply with the obligation of information to those persons identified under Article 14 the General Data Protection Regulation (GDPR) by providing the data subject directly with information.
Application of fines by President UODO
In March 2019 The President of the Office for Personal Data Protection (UODO) by administrative decision ordered compliance with the obligation to provide certain information under Article 14(1) and 2 GDPR by the penal company and imposed first a fine of more than 943,000 PLN for failure to comply with the information obligation by an entrepreneur who, for commercial purposes, processed data of persons obtained from publicly available sources such as Central Records and Information on Business Activity, National Court Register or REGON.
Bisnode has been processing personal data of persons currently or in the past, as well as of those who have suspended their business activity. The punished company, in accordance with the requirements of the General Data Protection Regulation (GDPR), fulfilled its obligation to inform people who had e-mail addresses, however, for the other persons it only included an information clause on its website, with a view to bearing high costs of postal mail.
In these circumstances, the President of UODO considered that the data controller had failed to comply with the information obligation in relation to persons to whom he did not send the notification by letter, as the company had correspondence addresses and telephone numbers of those persons, and therefore, in the opinion of the President of UODO, it was possible to comply with the information obligation for persons whose data it was processing.
Given the purpose of the company's activities, i.e. the failure to send letters to persons whose data were processed, despite being aware of the obligation to provide relevant information and the need to inform them directly, the Authority concluded that the infringement by the company was intentional.
According to the President of UODO, the company deprived the persons indicated of the opportunity to exercise the fundamental rights which they enjoy under the GDPR, including, inter alia, the right to object to further processing of their data by the company, to request their rectification or removal, which resulted in the finding of serious infringements and the imposition of a monetary penalty.
disproportionately high cost to the entrepreneur
The company brought an action before the administrative court against the decision taken by the Authority. The penal company claimed that it was not subject to the information obligation mentioned under Article 14 GDPR is exempt on the basis of Article 14(5) point (b) GDPR, i.e. argued that providing such information would require disproportionately much effort, given the high cost of carrying out this obligation by sending information by post.
Judgment of the General Court
The Provincial Administrative Court (WSA) examining the contested decision, however, held that the possible high cost of sending this information by post does not constitute grounds for exemption from the information obligation, as confirmed by the position expressed by the President of UODO.
In its judgment, the WSA dismissed the action in respect of the order to comply with the information obligation in respect of natural persons currently engaged in economic activity and those who have suspended their activities, while in respect of those who have been active in the past, the decision of the President of the UODO in that part has been repealed by the Court of First Instance, as indicated by the Court.
The above case constitutes a reference point for entrepreneurs who consider making use of the exemption referred to under Article 14(5) point (b) GDPR i.e. where compliance with the information obligation would require disproportionate effort due to the high cost of fulfilling that obligation.
In view of the above-mentioned position of the authority and the judgment of the court, it should be pointed out that the high cost of sending this information by postal mail does not constitute a basis for exemption from the information obligation, and therefore the trader cannot rely on the so-called "an disproportionate effort".
However, the circumstances of the case should also be taken into account, as the report on the website of the President of UODO shows, the punished company did not take any action to remedy the infringements found. The fact that the data were processed by the administrator on a large scale is also important in the present case, since the failure to comply with the information obligation concerned, as the case may be, an administrative decision above 6,000,000 people, while of around 90,000 persons who have been informed of the processing of data above 12,000 the persons objected to the processing of their data.
It is also significant that, in view of the change in the number of entities affected by the infringement as a result of the judgment of the WSA, i.e. The repeal of the decision in the part concerning persons who have been active in the past, the President of UODO will also have to re-examine the issues of the level of penalties imposed on the company.
The above case should be distinguished from a similar case settled a few years ago by the General Inspector of Personal Data Protection concerning the processing of business data on the basis of data obtained from publicly available registers, but the data processor did not have any business addresses at the time and therefore was not able to inform them.