The President of the Personal Data Protection Office Appeals the Dismissal of the Investigation into the Creation of Nude Photos of a Schoolgirl

The prosecutor’s office issued a decision to dismiss the investigation into the publication on social media of doctored photos of a 14-year-old girl. Although, following the intervention of the President Mirosław Wróblewski, Prosecutor General Waldemar Żurek ordered the case to be reopened after the prosecutor’s office had refused to initiate an investigation in June 2025, the investigator made no new findings and dismissed the investigation.

The case began over a year ago when a parent of the victimised girl reported to the police a possible crime involving the manipulation of an image of his minor daughter. The President of the Personal Data Protection Office and the school attended by the victim also filed reports regarding this matter. The perpetrators of this act not only generated (using artificial intelligence) and published the photo, but also encouraged others to “order” it. Law enforcement authorities initially refused to open an investigation, stating that the act had not caused any harm and did not constitute a crime. The President of the Personal Data Protection Office appealed the prosecutor’s office’s decision, and when that proved unsuccessful, he sent a letter to Prosecutor General Waldemar Żurek requesting that the proceedings be reopened and an investigation launched. As a result of the President’s letter, the prosecutor’s office reopened the case.

However, in February 2026, the prosecutor issued a decision to discontinue the investigation. According to the case file, no new evidentiary actions were conducted at that time and no new factual findings were made—only the victim’s father was re-interviewed. In this situation, according to the President of the Personal Data Protection Office, just as on the previous occasion, the decision to discontinue the investigation was premature (this was the conclusion reached by the National Public Prosecutor’s Office when it ordered the proceedings to be resumed, and since the factual findings have not changed, it must be concluded that the decision was premature on this occasion as well).

The President of the Personal Data Protection Office points out that the prosecutor’s office handling the case has not, in particular, taken any steps to identify the perpetrators. Furthermore, the supervisory authority disagrees—once again—with the prosecutor’s office’s position that the publication of such a photo did not cause any harm, but was merely a form of a tasteless teenage prank. The father of the victimised student pointed out that he and his daughter feel wronged and do not wish for such photos to be published. In the supervisory authority’s view, harm was therefore inflicted, which constitutes a form of damage.

Above all, however, the President of the Personal Data Protection Office alleges in his complaint filed with the court that Article 107 of the Polish Act on the Protection of Personal Data Processed in Connection with Preventing and Combating Crime has been misinterpreted. This provision criminalises the processing of personal data without a legal basis. Meanwhile, the prosecutor’s office argues that altering a photograph, as in the case in question, does not constitute “processing of personal data” and that no crime was committed, since the image of the minor came from publicly available materials rather than from a “protected data set.”

However, from the perspective of personal data protection, such modification of a photograph constitutes the processing of personal data in the form of an image. The origin of the image is irrelevant—what matters is that it concerns an identifiable person. Furthermore, law enforcement did not specify what such a protected data set would be, what data it would contain, or why its protection would constitute an element of the crime under Article 107 of the Polish Act on the Protection of Personal Data Processed in Connection with Preventing and Combating Crime. The President of the Personal Data Protection Office emphasises that the case involved the processing of a minor’s data without a proper legal basis, and that the prosecutor’s office unjustifiably dismissed the proceedings in this matter.