On March 17, 2025, the President of the Personal Data Protection Office (UODO), Mirosław Wróblewski, decided to impose administrative fines on Poczta Polska and the Minister of Digital Affairs. Poczta Polska was fined 27 million PLN, while the Minister of Digital Affairs received the maximum statutory fine for public entities, amounting to 100,000 PLN. The reason was the unlawful processing of data belonging to nearly 30 million Polish citizens from the PESEL registry during the organization of the so-called postal elections in 2020.
Unjustified Disclosure of PESEL Data
In his decision, the UODO President emphasized that the unlawful disclosure and processing of personal data from the PESEL registry by Poczta Polska violated citizens’ constitutional rights. Every citizen has the right to privacy, honor, and a good reputation, as well as the right to decide about their personal life. The UODO decision clearly confirms that the actions of Poczta Polska and the Minister of Digital Affairs were in violation of the GDPR regulations.
Context of the Case – Postal Elections
In the spring of 2020, during the COVID-19 pandemic, the government attempted to organize the presidential elections via mail-in voting. On April 16, 2020, the Prime Minister issued an administrative decision instructing Poczta Polska to begin preparations for this process. Consequently, Poczta Polska requested access to citizens’ data from the PESEL registry from the Minister of Digital Affairs. The minister agreed to share this data, which was delivered on a DVD on April 22, 2020.
Following the decision to cancel the elections on May 10, 2020, the citizens’ personal data was not destroyed until between May 15 and May 22, 2020. In the meantime, many citizens filed complaints with the UODO regarding the unlawful disclosure of their data.
Citizens’ Complaints and Court Rulings
Initially, the then-President of the UODO, Jan Nowak, dismissed citizens’ complaints as unfounded. However, the Commissioner for Human Rights (RPO) took legal action, filing complaints with the Provincial Administrative Court (WSA) in Warsaw.
On September 15, 2020, the WSA ruled that the Prime Minister’s decision to organize postal elections was a gross violation of the law, a ruling later upheld by the Supreme Administrative Court (NSA) on June 28, 2024. On February 26, 2021, the WSA also ruled that the Minister of Digital Affairs’ action in sharing PESEL data with Poczta Polska was legally ineffective. This ruling was confirmed by the NSA on March 13, 2024.
The finalization of these court rulings unequivocally confirmed that the disclosure and processing of the personal data of 30 million citizens lacked any legal basis.
UODO President’s Findings
Following an administrative investigation, the UODO determined that the Minister of Digital Affairs had provided Poczta Polska with the following data:
- PESEL number,
- First and last names,
- Permanent and temporary residence addresses,
- Information about temporary stays abroad.
Upon receiving this data, Poczta Polska processed it unlawfully, violating fundamental principles of personal data protection. The UODO President emphasized that the Minister of Digital Affairs, as the administrator of the PESEL registry, was not only obligated to comply with the law but also to ensure the protection of citizens’ data. Instead, he handed over the data to Poczta Polska in an authoritative manner without appropriate legal grounds.
Consequences of the Violation
The UODO President determined that the scale of the violation was immense, affecting nearly 80% of Poland’s population. He also noted that the actions of the Minister of Digital Affairs and Poczta Polska could lead to serious non-material harm for citizens, such as losing control over their personal data and concerns about its further misuse.
The UODO’s decision also pointed out that Poczta Polska, as a state-owned company, should exercise the highest level of diligence in protecting personal data. Upon receiving the Prime Minister’s decision to prepare for the elections, it should have conducted a legal analysis of processing PESEL data, which it failed to do.
