Key Focuses Of The Polish Data Protection Authority

Like in every other GDPR jurisdiction, in Poland the Data Protection Authority ("DPA") is obliged to prepare its annual statement by the end of August every year. An analysis of the DPA's reports and statements as well as of its daily work reveals which issues Polish data controllers and processors are struggling with the most.

Marketing

A frequent subject of complaints submitted to the DPA is the processing of personal data for marketing purposes, mainly in terms of noncompliance with information obligations or failure to consider the data subject's objections. In one case, a complainant alleged that a company sent him numerous marketing e-mails and text messages even though he was not bound to the company by any contract. The complainant requested that his personal data be deleted. The company originally processed the complainant's data for the purpose of executing a contract to which the complainant was a party. However, the DPA determined that the lapse of a