The Voivodeship Administrative Court in Warsaw overturns the Personal Data Protection Office’s decision imposing a fine on Polish Post (Poczta Polska)

The fine of PLN 27 million imposed by the President of the Personal Data Protection Office was overturned on Thursday by the Voivodeship Administrative Court in Warsaw. The Court found that Polish Post had a legal basis for processing the data of 30 million Polish citizens for the purpose of organising the postal vote in the 2020 presidential election. At the time these actions were taken, the Prime Minister’s decision on which the company relied enjoyed a presumption of validity – even though administrative courts later declared it null and void.

On 5 March 2026, the Voivodeship Administrative Court in Warsaw issued a judgment in case II SA/Wa 837/25, following a complaint lodged by Polish Post against the decision of the President of the Personal Data Protection Office. The Court held that the complaint was justified and annulled the decision insofar as it concerned Polish Post.

According to the Court, the decision of the Prime Minister of 16 April 2020, which obliged Polish Post to undertake preparations for the postal presidential election, was binding on the company until it was declared invalid. This occurred only four years later. Therefore, it cannot be concluded that Polish Post processed personal data without a legal basis, as the Prime Minister’s decision remained in legal circulation at the time and benefited from the presumption of legality.

The Court also noted that not all consequences of executing such a decision can be reversed. Among these irreversible consequences are the processing of personal data itself, as well as the passage of time.

The Court: Polish Post could not assess the legality of the Prime Minister’s decision

In the Court’s view, when examining the complaint by Polish Post against the decision of the President of the Personal Data Protection Office, the supervisory authority should have assessed whether, at the time of the processing activities, Polish Post had grounds to act under the Prime Minister’s instruction.

The Court found that Polish Post, as the addressee of the Prime Minister’s decision, could not refuse to comply with it. Such refusal could have resulted in compulsory enforcement under administrative enforcement procedures. The addressee could challenge the decision only through the legal route provided – namely, by appealing to an administrative court. However, according to the Court, even such an appeal did not justify refusing to comply, as the decision enjoyed a presumption of legality and remained binding until it was finally quashed or declared invalid.

Since, at the time of the personal data processing, a decision imposing the above-mentioned obligations on the company was in legal circulation, it was the role of the President of the Personal Data Protection Office to assess whether the processing served the execution of the Prime Minister’s instruction.

Background of the case

The case dates back to 2020, when preparations were underway for the presidential election during the COVID‑19 pandemic. To reduce the risk of infection caused by large gatherings in polling stations, the election was planned to be conducted by post. This required an amendment to the law, which, however, had not entered into force by April 2020 (the election was scheduled for 10 May). As a result, on 16 April 2020, the Prime Minister issued a decision obliging Polish Post to take action to organise the postal vote – which required, among other things, obtaining personal data of 30 million adult residents of Poland.

On the basis of this decision, on 20 April 2020 Polish Post requested the Ministry of Digital Affairs to provide the data from the PESEL register. The data were delivered on a DVD two days later. Processing continued for a month, as the data were destroyed only between 15 and 22 May, once it became clear that the election would not take place in the planned form or on the planned date. The data included: PESEL numbers, first and last names, permanent or temporary residence addresses, and information on registered temporary departures abroad.

On 29 April 2020, the Commissioner for Human Rights lodged a complaint with the Voivodeship Administrative Court in Warsaw against the Prime Minister’s decision of 16 April 2020. In response, the Court ruled on 15 September 2020 (VII SA/Wa 992/20) that the contested decision not only grossly violated the law but had also been issued without a legal basis (Article 156 § 1(2) of the Code of Administrative Procedure). This judgment was upheld by the Supreme Administrative Court on 28 June 2024 (III OSK 4524/21).

The Personal Data Protection Office’s decision to fine Polish Post

Following the administrative courts’ finding that the processing of data of 30 million Poles had been based on a null and void decision, and in light of numerous complaints submitted to the Office, the President of the Personal Data Protection Office initiated ex officio administrative proceedings to assess the lawfulness of the actions of Polish Post and the Ministry of Digital Affairs. These proceedings concluded with a decision issued on 17 March 2025, in which the President of the Office found that the infringements attributed to Polish Post were serious and violated fundamental principles of personal data processing.

Additional aggravating factors included the scope of the data processed and the large number of individuals affected – nearly 80% of Poland’s population. The unlawful processing exposed them to non-material harm, particularly fear and uncertainty resulting from the loss of control over their personal data. The authority also emphasised that Polish Post, as a state‑owned company performing public tasks, should exercise the highest diligence and comply with applicable laws, including data protection regulations. In the President’s view, after receiving the Prime Minister’s decision of 16 April 2020, the company should have conducted an in‑depth analysis of whether it provided a legal basis for processing data from the PESEL register.

The actions of the Ministry of Digital Affairs were also found unlawful. Consequently, the supervisory authority imposed a fine of PLN 100,000 on the Minister of Digital Affairs – the maximum possible for public entities – which the Ministry paid.

The judgment of the Voivodeship Administrative Court of 5 March 2026 overturning the Personal Data Protection Office’s decision concerning Polish Post is not final. The supervisory authority may lodge a cassation appeal with the Supreme Administrative Court.