The company will pay over 200 thousand PLN for GDPR violation

The Supreme Administrative Court (NSA) dismissed the cassation complaint of ClickOuickNow on November 12, 2024, upholding the decision of the President of the Personal Data Protection Office (UODO) to impose a financial penalty of 201,559.50 PLN. This ruling closes a long-standing dispute regarding the data administrator’s GDPR violations.

Withdrawing consent to data processing made difficult

The basis for imposing the penalty was the UODO President’s decision from October 16, 2019, in which it was indicated that ClickOuickNow hindered the process of withdrawing consent to personal data processing. Instead of allowing users to easily withdraw consent – in line with the principle that it should be as simple as giving it – the company introduced complicated technical and organizational solutions.

NSA, like the earlier Provincial Administrative Court (WSA) in Warsaw, shared the UODO’s position. In the oral justification of the judgment, the court emphasized that the hyperlinks placed in the commercial information of ClickOuickNow misled users. After clicking on the link, people trying to withdraw their consent were forced to give the reason for their decision, and the lack of indicating it prevented the effective revocation of consent.

Misleading users

The court discussed in detail the practices used by the company, which violated the rights of the individuals whose data were processed. Users were receiving messages that gave the impression that the consent had been withdrawn, e.g., text: “Your consent withdrawal today 13.02.2019!”, while in reality, this process was not completed. Such actions were against the law and undermined trust in the procedures used by the company.

Scope of the problem

NSA pointed out the massive scale of the phenomenon. As of January 31, 2019, ClickOuickNow was processing the personal data of more than 2.1 million people. The UODO President’s decision also indicated that the company was processing data of people who were not its customers and from whom it received a request to cease data processing. This way, they violated the right to erase personal data, one of the fundamental rights guaranteed by GDPR.

The NSA’s verdict means that ClickOuickNow must pay the imposed financial penalty. The court’s decision not only concludes the proceedings but also creates an important precedent in enforcing personal data protection rules.