On May 28, 2024, the European Court of Human Rights (ECHR) ruled on the case of Pietrzak, Bychawska-Siniarska and Others v. Poland (applications no. 72038/17 and 25237/18). The complaint by individuals representing NGOs and attorney Pietrzak concerned Polish legislation allowing services to collect information about citizens under the pretext of combating crime and public safety threats.
In yesterday’s judgment issued by the full Chamber, the ECHR indicated that there had been a violation of Article 8 of the Convention for the Protection of Human Rights and Fundamental Freedoms (ECHR), which provides for the right to respect for private life, in relation to the regime of operational control, the retention of telecommunications data, and their use for the purposes of services, as well as secret surveillance conducted under anti-terrorism law provisions.
Importantly, the ECHR held that it is possible to examine the contested provisions in abstracto, without the complainants having to prove that surveillance actually took place. The mere existence of the provisions that were the subject of the complaint may constitute an unjustified interference with the right under Article 8 of the Convention.
Judgments of the European Court of Human Rights, especially those interpreting Article 8 of the ECHR, are significant guidelines for the actions of the President of the Office for Personal Data Protection (UODO). The President of the Office is not exclusively concerned with the GDPR; according to the provisions of the Data Protection Act of May 10, 2018, he is the competent authority for the protection of personal data and has the right to issue statements aimed at ensuring effective data protection. Therefore, the President of UODO’s analyses include not only the judgments of the Court of Justice of the European Union, which interpret the GDPR, but also all other acts and documents that may impact the assessment of the legal situation in Poland.
The President of UODO welcomed with great satisfaction the declaration made yesterday by the Minister of Justice and the Minister of Interior and Administration, stating that actions to implement the judgment will be undertaken immediately.
On this occasion, we would like to draw attention to the fact that the Sejm is currently processing a government bill – the Electronic Communications Law, implementing the directive establishing the European Communications Code into Polish law, to which the President of UODO raised objections during the governmental work stage. In the opinion of the President of UODO, the bill maintains a model of data retention and access for authorized entities that is inconsistent with the jurisprudence of the Court of Justice of the EU (and now presumably also with the ECHR ruling).
It is also necessary to remind of the need to revisit the topic of implementing into Polish law the provisions of Directive (EU) 2016/680 of the European Parliament and of the Council (the so-called Police Directive), concerning the processing of personal data by competent authorities for the purpose of the prevention, investigation, detection or prosecution of criminal offences. Particularly, a reanalysis is required for the personal exemptions adopted by the Polish legislator, according to which the implementing act does not apply to the services specified in the act. There is also a need for discussion regarding effective oversight of services processing personal data (also in the context of Article 51 of the Polish Constitution), as well as the practical possibility of exercising the rights of individuals whose data are being processed.
In the near future, the President of UODO will take actions in accordance with the powers arising from the provisions of the Data Protection Act, including directing appropriate requests to the relevant authorities for urgent legislative changes.
