The Voivodeship Administrative Court dismissed the complaint of the Chief Commander of the Police

In its judgment of 28 January 2026, in case no. II SA/Wa 890/25, the Voivodeship Administrative Court in Warsaw dismissed the complaint lodged by the Chief Commander of the Police against the decision of the President of the Personal Data Protection Office.

The decision challenged by the Chief Commander of the Police was issued following proceedings concerning a complaint about the disclosure, during a press conference, of data and information relating to a woman’s state of health and her private life. In this case, the President of the Personal Data Protection Office found that the Chief Commander of the Police had infringed the provisions of the General Data Protection Regulation (GDPR), specifically Article 6(1) and Article 9(1), and imposed an administrative fine of PLN 75,000.

The Voivodeship Administrative Court in Warsaw fully upheld the position of the President of the Personal Data Protection Office, including the reasoning presented and the legitimacy of imposing the administrative fine.

In the decision, the President of the Personal Data Protection Office stated that the infringement of the GDPR by the Chief Commander of the Police was of a serious nature, as it involved the disclosure of data without a legal basis, including information belonging to a special category of personal data. The information disclosed at the press conference could be linked to earlier media reports concerning the complainant and her personal history. The disclosure of the data by the Chief Commander of the Police created both a potential and an actual possibility that third parties could use the information without the knowledge or consent of the data subject, and it carried the risk of harm in the form of exposure to discrimination, loss of reputation, and loss of control over the processing of information about oneself.

The President of the Personal Data Protection Office also emphasised that public authorities are not beneficiaries of the freedom of the press and other mass media. Therefore, the Police press conference did not constitute an activity involving “editing, preparing, creating or publishing press materials”. This was also confirmed by the court in its oral reasoning. The special-category personal data disclosed during the press conference did not constitute press material within the meaning of the Press Law Act of 26 January 1984 (Journal of Laws 2018, item 1914). Consequently, this could not be considered a legal basis for the disclosure of personal data under the GDPR.