Failure to provide access to personal data and information may result in an administrative fine

The President of the Personal Data Protection Office, Mirosław Wróblewski, imposed an administrative fine of PLN 31 507 on an entrepreneur based in Kraków. The entrepreneur was the controller of personal data processed through the websites he operated. Initially, the controller cooperated with the supervisory authority in the course of proceedings initiated to investigate possible infringements of data protection legislation in connection with the processing of personal data through those websites. However, the controller ultimately failed to provide the President of the Personal Data Protection Office with the information necessary to resolve the case.

The President of the Personal Data Protection Office received information indicating possible irregularities in the operation of the websites lexspace.pl and adwokatura.info. The websites were used to process the personal data of legal professionals (attorneys-at-law and advocates) and individuals seeking legal advice. However, the websites did not provide the controller's contact details, preventing data subjects from effectively exercising their rights relating to privacy and the protection of personal data.

The supervisory authority established that both websites were linked to the business activities of an entrepreneur based in Kraków, who subsequently confirmed that he was the controller of the personal data processed through those websites.

The explanations provided by the entrepreneur did not enable the President of the Personal Data Protection Office to establish the facts necessary to resolve the case. The controller failed to respond adequately to the supervisory authority's questions and was repeatedly requested to supplement the explanations he had previously submitted. The controller was informed that failure to provide the supervisory authority with the information necessary for the President of the Personal Data Protection Office to perform his tasks could result in the imposition of an administrative fine.

Despite numerous attempts by the Personal Data Protection Office staff to contact the controller, including by telephone and email, he failed to respond to repeated requests for further explanations. The controller's passive, or even dismissive, attitude towards the supervisory authority and the ongoing proceedings prevented the President of the Personal Data Protection Office from conducting an objective, thorough and comprehensive examination of the case. Consequently, the imposition of an administrative fine became necessary.

Decision in Polish: DKE.561.7.2026