Can the data of judges undergoing an independence and impartiality test be published?

The First President of the Supreme Court, Małgorzata Manowska, has approached the President of the Personal Data Protection Office (UODO) for clarification on how to implement the provisions of the Act of 6 September 2001 on Access to Public Information while respecting the right to privacy. The matter concerns determining whether the personal data of judges from common and military courts undergoing the so-called independence and impartiality test, included in the judgments of the Supreme Court and their justifications, which are to be published in the Public Information Bulletin on the Supreme Court's website pursuant to Article 8 of the Supreme Court Act, should be anonymized prior to publication.

The President of the Personal Data Protection Office (UODO) responded that the case involves a conflict between two constitutional rights: the right to public information and the right to privacy. Neither of these rights is absolute, and both are subject to limitations, particularly when they intersect. When publishing the personal data of judges contained in Supreme Court judgments and their justifications, it must be determined whether the disclosed information is related to the performance of their public duties. If so, the information is subject to publication. However, it is the Supreme Court itself that must make this assessment.

• The right of access to public information is defined in Article 61 of the Constitution, which states that ,,A citizen shall have the right to obtain information on the activities of organs of public authority as well as persons discharging public functions " This right is further detailed in the Act on Access to Public Information (u.d.i.p.).
• On the other hand, the right to privacy originates from Articles 47 and 51 of the Constitution, as well as Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.
• The General Data Protection Regulation (GDPR) recognizes the disclosure of personal data contained in official documents (including Supreme Court judgments and their justifications) as one of the specific situations involving data processing. It permits such disclosure provided certain conditions are met. These conditions are outlined in Article 86 of the GDPR. Additionally, Recital 154 of the Regulation offers guidance on the interpretation of this provision, which should also be taken into account.

The reasoning of the President of the Personal Data Protection Office

The substantive legal basis for publishing Supreme Court judgments along with their justifications in the Supreme Court's Public Information Bulletin (BIP SN) is Article 8 of the Supreme Court Act. Formally, it meets the requirements of Article 86 of the GDPR and constitutes a basis for legalizing such processing of personal data under Article 6(1)(c) GDPR and Article 9(2)(g) GDPR. The legislator has classified the judicial activity (specifically, the content of judgments and their justifications) of the Supreme Court as public information, which, as a result, is subject to disclosure.

The provision that ensures a balance between the right to public access to official documents and the right to personal data protection is Article 5(2) of the Act of 6 September 2001 on Access to Public Information (u.d.i.p.). It limits the right to public information on the grounds of an individual's privacy. However, the privacy of a person holding a public function is not absolute under the u.d.i.p. It does not cover information related to the performance of that function, including the conditions of its appointment and execution.

The publication in the Public Information Bulletin of the Supreme Court of the Court's judgments (with justifications) containing personal data of judges from common courts or military courts sitting as members of the first-instance or appellate court, undergoing the so-called independence and impartiality test, should take place with due regard for the rights of these individuals under the GDPR and in compliance with its provisions.

It should be emphasized that the supervisory authority cannot replace the data controller in assessing whether a specific piece of information contained in a judgment is related to the performance of a judge's function or the conditions of appointing and performing that function. The data controller who discloses the data or makes a negative decision in this regard bears sole responsibility in this matter.