The MPs – Waldemar Buda and Michał Woś – were reprimanded for their lack of cooperation with the President of the Personal Data Protection Office

The President of the Personal Data Protection Office, Mirosław Wróblewski, reprimanded MPs Waldemar Buda and Michał Woś for violating the provisions of the GDPR by failing to provide the supervisory authority with access to information necessary to perform its tasks.

During the 2025 presidential campaign, the President of the Personal Data Protection Office received notifications of a probable personal data breach by both MPs. According to their content, personal data were disclosed on social media platforms – X and Facebook. At that time, details of the eviction case were disclosed, including the personal data of the parties to the proceedings. After the initiation of administrative proceedings, the President of the Personal Data Protection Office asked both MPs to provide information needed to investigate the circumstances indicated in the notifications. You can read about the case in a press release published on our website https://uodo.gov.pl/en/553/2082

The President of the Personal Data Protection Office conducted many proceedings in the case of persons disclosing personal data during last year's presidential campaign – including presidential candidates and their election committees. You can read more about this in the press release: Reprimands for election committees of presidential candidates for disclosing citizen's data.

For the public disclosure of personal data recorded in documents, the President of the Personal Data Protection Office imposed an administrative fine on one of the committees. You can read about the case in the press release: Election Committee of Karol Nawrocki breached the GDPR by making personal data publicly available .

MPs Waldemar Buda and Michał Woś, despite being sent correspondence to each of them twice, did not provide the supervisory authority with the necessary information. The correspondence sent to them remained unanswered or was returned to the supervisory authority with a note about the failure to collect correspondence within the official deadline. Due to the lack of reaction from both MPs, the President of the Personal Data Protection Office initiated two separate proceedings to impose an administrative fine for failing to respond to the supervisory authority's requests for explanations.

Despite the obvious negligence on the part of the MPs, the breach was removed by them immediately after having become aware of the ongoing proceedings concerning the possibility of imposing an administrative fine. The moment data breach had been removed was considered to be the moment of receipt of explanations by the supervisory authority. The President of the Personal Data Protection Office, taking into account the fact that the MPs had begun cooperation and submitted explanations, decided that in these circumstances it would be sufficient to issue a reprimand, and therefore resigned from the imposition of a fine.

DKE.561.10.2025

DKE.561.11.2025