NSA - III OSK 5037/21

Date of judgment 2025-04-29 Final judgment Date of receipt 2021-06-09 Court Supreme Administrative Court Judges Ireneusz Dukiel Jerzy Stelmasiak Przemysław Szustakiewicz /Presiding Rapporteur/ Symbol with description 647 Cases related to personal data protection Thematic keywords Personal data protection Related references II SA/Wa 1264/20 - Judgment of the Regional Administrative Court in Warsaw of 2021-02-15 Accused authority Inspector General for Personal Data Protection Content of the result The appealed judgment and the second instance decision were set aside. Referenced provisions Journal of Laws 2002, No. 153, item 1270, Article 188 in conjunction with Article Article 145 § 1 item a Act of August 30, 2002, the Code of Administrative Court Procedure. Opening Order The Supreme Administrative Court, composed of: Presiding Judge: Przemysław Szustakiewicz (rapporteur) of the Supreme Administrative Court; Judges: Jerzy Stelmasiak, Judge of the Provincial Administrative Court; Ireneusz Dukiel, Clerk of the Court; Senior Assistant to Judge Joanna Ukalska, having considered on April 29, 2025, at the hearing in the General Administrative Chamber, the cassation appeal filed by the Commissioner for Human Rights against the judgment of the Provincial Administrative Court in Warsaw of February 15, 2021, file ref.

Case No. II SA/Wa 1264/20, regarding the complaint of the Commissioner for Human Rights against the decision of the President of the Personal Data Protection Office of April 6, 2020, No. I, regarding the discontinuance of the proceedings, quashes the appealed judgment and the contested decision. Justification By its judgment of February 15, 2021, Case No. II SA/Wa 1264/20, the Provincial Administrative Court in Warsaw dismissed the complaint of the Commissioner for Human Rights against the decision of the President of the Personal Data Protection Office of April 6, 2020, No. I, regarding the discontinuance of the proceedings. The following factual and legal circumstances were established in the case: The Commissioner for Human Rights, in a letter dated March 9, 2020; requested the President of the Personal Data Protection Office to initiate administrative proceedings in a case concerning the compliance of the obligation for judges and prosecutors to submit a declaration of membership in an association, including an association - introduced pursuant to Art.

1 point 29 and Art. 6 point 1 of the Act of 20 December 2019 amending the Act - Law on the System of Common Courts, the Act on the Supreme Court and certain other acts (Journal of Laws of 2020, item 190, hereinafter "Amendment of 2019") - with the provisions on personal data protection. The Ombudsman also requested the issuance as part of these proceedings - pursuant to Art. 70 sec. 1 of the Personal Data Protection Act of May 10, 2018 (Journal of Laws of 2019, item 1781, hereinafter referred to as the "Data Protection Act") – a provision restricting the processing of personal data of persons required to submit a declaration of membership in associations, including associations, with particular emphasis on membership in churches and religious unions, as well as associations of judges and prosecutors performing functions similar to trade unions, by prohibiting the publication of the content of these declarations in the Public Information Bulletin until the conclusion of the proceedings before the authority.

The President of the Personal Data Protection Office, by decision of April 6, 2020, No. I, pursuant to Art. Pursuant to Article 105 § 1 of the Code of Administrative Procedure, the court dismissed ex officio proceedings concerning a violation of personal data protection regulations, in connection with the obligation for judges and prosecutors to submit and publish declarations of membership in associations, including associations. The court stated that, pursuant to Article 88a § 1 of the Act of July 27, 2001 - Law on the System of Common Courts (Journal of Laws of 2020, item 365), a judge is obligated to submit a written declaration of: 1) membership in an association, including an association - specifying the name and registered office of the association, the functions performed, and the period of membership; 2) function performed in a governing body of a foundation not conducting business activity - specifying the name and registered office of the foundation and the period of service; 3) membership in a political party prior to appointment as a judge, as well as during the period of office before 29 December 1989 – indicating the name of the party, functions performed, and period of membership.

Pursuant to Art. 88a § 2 of this Act, judges shall submit the declarations referred to in § 1 to the president of the relevant court of appeal, and presidents of courts of appeal – to the Minister of Justice. In turn – pursuant to § 3 of this provision – the declarations referred to in § 1 shall be submitted within 30 days of taking office as a judge, and also within 30 days of the occurrence or cessation of the circumstances referred to in § 1. Pursuant to Art. Pursuant to Article 88a § 4 of the Act on the System of Common Courts, the information contained in the declarations referred to in § 1 is public and must be made available in the Public Information Bulletin (BIP), referred to in the Act of September 6, 2001, on Access to Public Information (Journal of Laws of 2019, item 1429, as amended) – no later than 30 days from the date of submitting the declaration to the authorized entity.

The authority indicated that similar regulations are contained in Article 8 § 2 of the Act of July 25, 2002, on the System of Administrative Courts (Journal of Laws of 2019, item 2167, as amended), pursuant to which the declaration referred to in Article Pursuant to Article 88a of the Act on the System of Common Courts, judges of the provincial administrative court submit their reports to the relevant president of the provincial administrative court, while the president of the provincial administrative court and judges of the Supreme Administrative Court submit their reports to the President of the Supreme Administrative Court, and the President of the Supreme Administrative Court submit their reports to the National Council of the Judiciary. The provision of Article 88a of the Act on the System of Common Courts also applies – pursuant to Article 70 § 1 of the Act of 21 August 1997 – the Law on the System of Military Courts (Journal of Laws of 2019, item 2216, as amended) – to military courts, judicial assistants, and lay judges.

Pursuant to Article Pursuant to Article 45 § 3 of the Act of December 8, 2017, on the Supreme Court (Journal of Laws of 2019, item 825, as amended), a Supreme Court judge must submit the declaration referred to in Article 88a of the Act on the System of Common Courts to the First President of the Supreme Court, and the First President of the Supreme Court must submit it to the National Council of the Judiciary. Pursuant to Article 103a § 1 of the Act of January 28, 2016, on the Law on the Prosecutor's Office (Journal of Laws of 2019, item 740, as amended), a prosecutor is obligated to submit a written declaration of: 1) membership in an association, including a society – specifying the name and seat of the association, functions performed, and the period of membership; 2) function performed in a governing body of a foundation not conducting business activity – specifying the name and seat of the foundation and the period of service; 3) membership in a political party prior to appointment to the position of prosecutor, as well as during the period of holding office before 29 December 1989 – indicating the name of the party, functions performed and period of membership.

This obligation is unambiguous, as is the deadline for its fulfillment. These provisions also clearly imply the obligation to publish declarations in the BIP. Simultaneously, Article 6, paragraph 1 of the Act on the Organization of Common, Administrative, and Military Courts (BIP) also clearly implies, and this does not require interpretation. 2016, p. 1, as amended, hereinafter "GDPR"), the processing of personal data is lawful, among other things, when it is necessary for compliance with a legal obligation to which the controller is subject (letter c), and when it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller (letter e). In accordance with Article 57(1)(a) of the GDPR, without prejudice to other tasks specified under the relevant regulation, each supervisory authority monitors and enforces the application of the relevant regulation within its territory.

The corrective powers of the supervisory authority in the event of an infringement of the provisions of the GDPR are set out in Article 58(2)(a) to (j) of this Regulation. This provision provides, in particular, for the authority to issue warnings to the controller or processor regarding the possibility that intended processing operations may infringe the provisions of this Regulation (point a); to issue warnings to the controller or processor in the event of an infringement of the provisions of this Regulation by processing operations (point b); to order the controller or processor to bring processing operations into compliance with the provisions of this Regulation, and, where appropriate, specify the method and time limit (point d); to impose a temporary or complete restriction of processing, including a prohibition of processing (point f); and to impose, in addition to or instead of the measures referred to in this paragraph, an administrative fine pursuant to Article 83, depending on the circumstances of the specific case (point i).

Pursuant to Article 1, Section 2, Item 5 of the Data Protection Act, this act specifies the procedure for infringements of personal data protection provisions. Pursuant to Article 60 thereof, the authority conducts proceedings for infringements of personal data protection provisions. It follows from the above that the proceedings conducted by the authority are aimed at determining whether a violation of personal data protection provisions has occurred in the case and, if such a violation is found, at exercising the remedial powers. The assessment is therefore aimed at examining the validity of the supervisory authority's exercise of the remedial powers referred to in Article 58, Section 2 of the GDPR. With the above in mind, the President of the Personal Data Protection Office (UODO) indicated that the disputed processing of personal data of judges and prosecutors is the result of these individuals' fulfillment of an obligation clearly defined in the law.

This processing is therefore based on Article 6, Section 1, Item c of the GDPR. Consequently, the authority has no basis for determining a violation of personal data protection provisions. This means that further proceedings – aimed at the possible exercise of the remedial powers provided for in Article 58, Section 2 of the GDPR – are ineffective. 2 GDPR – is moot within the meaning of Article 105 § 1 of the Code of Administrative Procedure. Referring to the Commissioner's assertions regarding the unconstitutionality of the cited provisions establishing the obligation for judges and prosecutors to submit declarations of membership in an association, including an association, and to make them public – in particular the likelihood of a violation of Article 53 § 7 of the Constitution of the Republic of Poland, the President indicated that, within the scope of the powers granted to him under Article 57 GDPR, he did not have jurisdiction to decide this issue.

Pursuant to Article 33 § 1 of the Code of Administrative Procedure, Pursuant to Article 1, Section 1, Item 1 of the Act of November 30, 2016, on the Organization and Procedure before the Constitutional Tribunal (Journal of Laws of 2019, item 2393), the Tribunal adjudicates matters of constitutionality of statutes and international agreements. Therefore, the Constitutional Tribunal is the competent body to which the Commissioner for Human Rights may submit the comments contained in the letter of March 9, 2020. Pursuant to Article 16, Section 2, Item 2 of the Act of July 15, 1987, on the Commissioner for Human Rights (Journal of Laws of 2018, item 2179, as amended), the Commissioner may submit motions to the Constitutional Tribunal regarding the constitutionality of statutes. Unlike the Commissioner, the body competent in matters of personal data protection does not have the authority to submit such motions to the Constitutional Tribunal.

The Commissioner for Human Rights filed a complaint against the above decision. In response to the complaint, the authority requested its dismissal, upholding its previous arguments. By the aforementioned judgment, the Regional Administrative Court in Warsaw, pursuant to Article 151 of the Act of 30 August 2002 – the Code of Administrative Court Procedure (Journal of Laws of 2019, item 2325, as amended; hereinafter referred to as the Administrative Court Procedure Act), found the complaint inadmissible. The court of first instance pointed out that Article 6(1) of the GDPR – specifying when the processing of personal data is permissible – is unambiguous in that the occurrence of one of the grounds enumerated in letters a-f is sufficient to legalize such an action. The rules for the permissibility of data processing under the grounds listed in letters c and e are further clarified in paragraph 3.

It is indicated there that the appropriate legal basis for processing must be established, for example, in the law of a Member State (see paragraph 3, sentence 1, letter b). In the case at hand, the basis for data processing was undoubtedly a binding normative act (the 2019 Amendment), which precisely defined what data, under what conditions, and to what extent they were to be processed. " However, contrary to the Advocate General's view, neither the provisions of the recitals cited by him nor the regulations outlining the tasks of the specialized body – endowed with competences under the Regulation itself – contain provisions from which the body's competence to assess the legality of generally applicable regulations in the territory of the Member State where it performs its tasks could be inferred. The Regional Administrative Court in Warsaw argued that the competence to assess adopted statutory regulations cannot be derived by specialized data protection bodies from the assignment of tasks specified in Article 57, paragraph 1 of the GDPR to them – including: general competence to monitor and enforce the provisions of the regulation (a) - nor the competences arising from Article 58 of the GDPR.

This provision grants the authority in question - within the scope of the proceedings conducted - specific rights towards the controller or the entity processing the data. , the content of paragraph 2, letters f and g. The corrective powers articulated throughout paragraph 2 concern the authority's competences within the framework of proceedings conducted against the controller or the entity processing the data listed in paragraph 1. Finally, Article 51 of the GDPR, cited in the complaint - specifying the obligation to establish a supervisory authority and indicating the purposes of its operation - cannot be treated as a basis for interpreting arbitrary competences when they serve the implementation of generally indicated tasks. The powers of a given authority have also been precisely defined by the EU legislator in other provisions of the given act. It is permissible to grant a specialized body broader powers under regulations established by national law.

However, if this were necessary to perform the body's tasks arising from the GDPR itself, the EU legislator would inevitably define them at the level of the relevant act. Therefore, it is impossible to derive from the regulations cited by the Commissioner the authority's competence to assess the ability of a specialized body to effectively apply applicable law within the territory of a given Member State. In the application, the purpose of which was to initiate proceedings before the authority – the President of the Personal Data Protection Office – the Commissioner requested an assessment of the lawfulness of data processing, the obligation of which arose directly from applicable laws (an undisputed circumstance). The Commissioner requested that the regulations covering data processing, contained in the applicable laws, be reviewed for compliance with the general principles of data processing arising from the provisions of the GDPR, taking into account general constitutional principles, provisions of other laws, and applicable international agreements – including the Charter of Fundamental Rights of the Treaty of Lisbon and the Rome Convention, which are binding on the content of the Treaty of Lisbon.

" The latter – especially when included in higher-level acts (such as a constitution or international agreement) – often serve as sui generis guidelines for shaping more specific regulations – when adopting strict norms. A characteristic, or even specific, feature of general clauses is that – in the lawmaking process – it is necessary to appropriately balance the general principles arising from them with the need to protect other interests, including the effective functioning of the state – the institutions fulfilling its tasks. Sometimes they even expressly express the obligation to weigh individual arguments – as in Article 6, paragraph 3, sentence 3 of the GDPR. The authority to assess generally applicable law and apply specific remedies cannot be derived solely from the principles of EU law cited in the complaint, or from ensuring its effectiveness. Importantly, such an assessment falls outside the scope of the authority's powers granted to it under Article 58 of the GDPR regarding the conduct of proceedings.

According to the Court of First Instance, there are no provisions granting the authority competent for personal data protection the authority to determine whether applicable legal regulations are consistent with the general clauses regarding the right to personal data protection – for example, in the context of restrictions imposed on persons holding public offices (judges and prosecutors). Nor do the provisions adopted at the national level (in particular, the Constitution of the Republic of Poland) grant the specialized authority the authority to assess legal norms (laws) enacted by Parliament in the context of their compliance with the general clauses. It should also be noted that the authority in question was not authorized to issue acts that would result in the suspension of the performance of obligations arising from generally applicable law. In particular, such prerogatives cannot be derived from Article 70 of the Data Protection Act.

It provides for special measures, but they are applicable only during administrative proceedings, which in Polish law are conducted exclusively in individual cases (see Article 1, Section 1 of the Code of Administrative Procedure), and which adjudicate the rights and obligations of specific individuals or entities. In the current legal system, no authority is assigned the authority to conduct administrative proceedings concerning a general order to suspend the performance of obligations arising from a specific, applicable normative act. A decision issued in such proceedings would also not have the nature of an individual act. In light of the comments contained in the justification of the complaint, which invoked the Court's (including the administrative) authority to directly apply constitutional rules, it should be noted that a key element of the case at hand is the assessment of whether a specific, specialized body was authorized to review the compliance of applicable normative acts with the general clauses.

Consequently, the authority correctly applied Article 105 § 1 of the Code of Administrative Procedure and discontinued the proceedings. The Regional Administrative Court in Warsaw also agreed with the authority that – within the scope of its powers under Article 57 of the GDPR – it does not have jurisdiction to rule on the constitutionality of provisions introducing the obligation for judges and prosecutors to submit declarations of membership in an association, including an association, and to make such declarations public. Pursuant to Article 188 § 1 of the Constitution of the Republic of Poland, the Constitutional Tribunal is authorized to assess the constitutionality of statutes. Therefore, the Commissioner for Human Rights should have submitted the comments contained in the letter dated March 9, 2020 (pursuant to Article 16, paragraph 2, item 2 of the Act on the Commissioner for Human Rights).

The Commissioner's assessment of such action as pointless cannot constitute a sole basis for deriving additional jurisdiction for the authority competent for personal data protection matters or the administrative court reviewing the legality of the contested judgment. On May 10, 2021, the Commissioner for Human Rights filed a cassation appeal against the above judgment, challenging it in its entirety and requesting that the contested judgment be set aside in its entirety and the case be remanded to the Provincial Administrative Court in Warsaw for reconsideration. Alternatively, before the Supreme Administrative Court adjudicates the case, a preliminary question be referred to the Court of Justice of the European Union under Article 267, paragraph 3, of the Treaty on the Functioning of the European Union. The contested judgment was alleged to violate: - Article 8, paragraph 1, of the Charter of Fundamental Rights of the European Union.

2 of the Constitution of the Republic of Poland through its failure to apply, pursuant to which the provisions of the Constitution shall apply directly, unless the Constitution provides otherwise, within the scope of the application of the violated provisions of the Constitution of the Republic of Poland indicated in the Ombudsman's complaint; - Art. 3 of the Constitution of the Republic of Poland through its failure to apply, which provides that if it follows from an agreement ratified by the Republic of Poland establishing an international organization, the law established by it shall be applied directly and shall prevail in the event of a conflict with a statute and, therefore, the non-application of the provisions of the European Convention on Human Rights and the Charter of Fundamental Rights of the European Union indicated in the Ombudsman's complaint; - Art. 3 3 of the Constitution of the Republic of Poland through its non-application, which provides that if it results from an agreement ratified by the Republic of Poland establishing an international organization, the law established by that organization is applied directly, taking precedence in the event of a conflict with statutes, within the scope of the application of the violated provisions of the GDPR indicated in the Ombudsman's complaint; - Article 145 § 1 point 1 letter c of the Personal Data Protection Act through its non-application in the event of a breach of the supervisory authority's obligations by the President of the Personal Data Protection Office consisting in a breach of his obligations under Article 57 paragraph 1 letter a of the GDPR; - Article 145 § 1 point 1 letter a of the Personal Data Protection Act through its non-application, while the contested decision violated provisions of substantive law, which affected the outcome of the case.

- Article 6 paragraph 1 letters c and l e GDPR" through its incorrect interpretation; - Article 47 of the Constitution of the Republic of Poland, Article 7 of the Charter of Fundamental Rights of the European Union, and Article 8 paragraph 1 of the European Convention on Human Rights through their incorrect interpretation, and thus failing to ensure the exercise of the right to protection of the private life of entities whose rights and obligations were affected by the ongoing proceedings; - Article 51 paragraphs 1 and 2 of the Constitution of the Republic of Poland, Article 8 of the Charter of Fundamental Rights of the European Union, and Article 8 paragraph 1 of the European Convention on Human Rights through their incorrect interpretation, and thus failing to ensure the exercise of the right to protection of personal data of entities whose rights and obligations were affected by the ongoing proceedings; - Article 10 paragraph 1 of the Charter of Fundamental Rights of the European Union and Article 9 paragraphs 1 and 2 of the European Convention on Human Rights through their incorrect interpretation, and thus unjustified and disproportionate restriction on the exercise of freedom of conscience and religion by judges and prosecutors; - Article 53 paragraph 7 The Constitution of the Republic of Poland, through its erroneous interpretation, and thus their obligation to disclose their worldview, religious beliefs, or denomination.

In response to the cassation appeal, the President of the Personal Data Protection Office requested its dismissal as unfounded, indicating that the Ombudsman essentially duplicates the arguments of the complaint filed with the Court of First Instance. By order of March 22, 2022, reference number III OSK 5037/21, the Supreme Administrative Court admitted the Association of Polish Judges IUSTITIA to participate in the proceedings. On May 22, 2024, the President of the Personal Data Protection Office filed a procedural document in which, citing the judgment of the Court of Justice of the European Union of June 5, 2023, in Case C-204/21, European Commission v. Republic of Poland, he requested that the Ombudsman's cassation appeal be upheld, arguing that the judgment of the Court of Justice, which directly referred to the national provisions challenged by the Ombudsman, was the basis for the The contested decision of the President of the Personal Data Protection Office and at the same time containing their assessment in terms of compliance with EU law, are of significant legal significance for this case.

He noted that the Court of Justice in this judgment found the above-mentioned provisions of national law to be in breach of Article 7 and Article 8 paragraph 1 of the Charter of Fundamental Rights of the European Union and Article 6 paragraph 1, first subparagraph, points (c) and (e), Article 6 paragraph 3 and Article 9 paragraph 1 of the GDPR. Therefore, in the opinion of the authority, this judgment, as confirming the correctness of the position of the Commissioner for Human Rights expressed in the cassation appeal, cannot be disregarded when considering this case. In light of them, the position of the Commissioner for Human Rights regarding the infringement by both the Regional Administrative Court and the authority of Article 6 paragraph 1, points (c) and (e) of the GDPR in conjunction with Article 6 paragraph 3 of the GDPR in this case is justified. Article 6 paragraph 3 of the GDPR in fine provides that Union law or the law of a Member State must pursue an objective of public interest and be proportionate to the objective pursued.

designated, legitimate purpose. As the Commissioner for Human Rights pointed out, what is crucial in this case is that the EU legislator did not limit itself, in relation to the provision of national law that is to constitute the basis for the processing of personal data in connection with Article 6(1)(c) of the GDPR, to the formal requirement of its adoption and application. , it must serve the purpose of public interest and be proportionate to the designated, legitimate purpose. Moreover, as the GDPR stipulates, in the case of processing referred to in Article 6(1)(e) of the GDPR, it must be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Therefore, as the Commissioner noted, the Regional Administrative Court should take into account and apply the qualitative requirements, primarily concerning necessity and proportionality, arising from European Union law.

Basing the decision on a national provision that does not specify the purpose of processing data obtained through membership declarations, including in associations, including their public disclosure in the Public Information Bulletin, as well as the retention period for the disclosed data, was insufficient. The Supreme Administrative Court, by its order of November 20, 2024, file reference III OSK 5037/21, admitted the "Wolne Sądy" Foundation to participate in the proceedings as a participant. In its application for admission, the Foundation requested that the cassation appeal filed by the Commissioner for Human Rights be upheld, adding that the general purpose of the statutory amendments, which constituted the basis for the PUODO decision appealed by the Commissioner for Human Rights, was to "gather" all judges and prosecutors who are members of independent judicial associations, such as the "Iustitia" Polish Judges Association, the "Themis" Judges Association, or the "Lex Super Omnia" Prosecutors Association, in order to intimidate judges, including through excessive disclosure of their private data.

In On February 24, 2025, the Free Courts Foundation filed a motion to determine the existence of the ground of Article 5a of the Act of 2002 – the Law on the System of Administrative Courts – against Supreme Administrative Court Judge Przemysław Szustakiewicz. By order of March 5, 2025, file reference III OSK 5037/21, the Supreme Administrative Court dismissed the motion as not meeting procedural requirements. The Supreme Administrative Court considered the following: At the outset, it should be noted that, given that the Court of Justice of the European Union, in its judgment of June 5, 2023, in Case C-204/21, ruled in point 5 that the Republic of Poland, by adopting and maintaining in force Article 88a of the Law on the System of Common Courts, as amended, Article 45 § 3 of the Act on the Supreme Court, as amended, and Article 8 § 2 of the Law on the System of Common Courts, administrative courts in its amended wording, requiring judges of common courts, judges of the Supreme Court and judges of administrative courts to submit a written declaration on membership in an association, function held in a body of a foundation not conducting business activity and membership in a political party before being appointed to the position of judge, infringed the right to respect for private life and the right to the protection of personal data guaranteed by Article 7 and Article 8(1) of the Charter of Fundamental Rights of the EU and by Article 6(1), first subparagraph, letters c and e), Article 6(3) and Article 9(1) of the GDPR, the Supreme Administrative Court dismissed the Ombudsman's request contained in the cassation appeal to refer a question for a preliminary ruling to the Court of Justice of the European Union under Article 267, third paragraph, of the Treaty on the Functioning of the European Union as devoid of purpose.

A party appealing in cassation, wishing to invoke an allegation of a violation of these provisions, is obligated to directly link the allegation in question to an allegation of a violation of specific provisions which, in its opinion, the court of first instance violated during the examination of the case. A violation of the aforementioned provisions always results from a violation of other provisions, whether procedural or substantive (see judgment of the Supreme Administrative Court of 30 April 2015, file reference I OSK 1701/14). In the opinion of the Supreme Administrative Court, the cassation appeal, thus constructed and justified, alleging a violation of procedural provisions could not constitute an effective basis for challenging the correctness of the Court of First Instance's assessment of the appealed decision of the Personal Data Protection Office. In turn, the remaining procedural objections in the cassation appeal, like the allegations of violation of substantive law, actually revolve around the violation of Article 6 paragraph 1 letters c and e of the GDPR by the Regional Administrative Court in Warsaw through an incorrect interpretation limited solely to the provisions of national law – without taking into account the content of Articles 47, 51, and 53 paragraphs 1 and 2 of the Constitution of the Republic of Poland in conjunction with Article 8 and Article 9 paragraphs 1-2 of the European Convention on Human Rights, and Articles 8 and 10 paragraph 1 of the Charter of Fundamental Rights.

Consequently, this constitutes a failure to ensure the exercise of the right to privacy, including the right to disclose one's worldview, religious beliefs, or denomination, by judges and prosecutors. In this connection, it should be noted that the Court of Justice of the European Union, in its judgment of 5 June 2023, file ref. Case C-204/21, European Commission v. Republic of Poland, in point 5 of the judgment, ruled that "by adopting and maintaining in force Article 88a of the Act on the Organisation of Common Courts in its amended wording, Article 45 § 3 of the Act on the Supreme Court in its amended wording and Article 8 § 2 of the Act on the Organisation of Administrative Courts in its amended wording, requiring judges of common courts, judges of the Supreme Court and judges of administrative courts to submit a written declaration on membership in an association, function held in a body of a foundation not conducting business activity and membership in a political party before being appointed to the position of judge, the Republic of Poland has infringed the right to respect for private life and the right to the protection of personal data guaranteed by Article 7 and Article 8 paragraph 1 of the Charter of Fundamental Rights of the EU and by Article 6 paragraph 1, first subparagraph, points (c) and (e), Article 6 paragraph 3 and Article 9 § 1 of the GDPR.

In the Court's opinion, firstly, the provisions of the GDPR apply to Article 88a of the Act on the Organization of Common Courts, Article 45 § 3 of the Act on the Supreme Court, as amended, and Article 8 § 2 of the Act on the Organization of Administrative Courts (recital 325 of the judgment). Secondly, the collection and disclosure of data relating to a judge's membership in a political party and the functions performed therein constitutes processing that may reveal the judge's political views within the meaning of Article 9 § 1 of the GDPR (recital 346 of the judgment). Thirdly, with respect to information relating to a judge's membership in an association and the functions performed therein, the processing of his data and making it available in electronic form may reveal his philosophical or religious beliefs within the meaning of Article 9 § 1 of the GDPR (recital 347 of the judgment).

In summary, the Court found that the processing of personal data within the scope established in Article 88a of the Act on the Organization of Common Courts, Article 45 § 3 of the Act on the Organization of Administrative Courts, and Article 8 § 2 of the Act on the Organization of Administrative Courts. Article 45 § 3 of the Act on the Supreme Court, as amended, and Article 8 § 2 of the Act on the Organization of Administrative Courts constitute a particularly serious interference with the rights of data subjects, as set out in Articles 7-8 of the Charter of Fundamental Rights (recital 378 of the judgment), and that the aforementioned provisions of Polish law violate both the provisions of Article 6(1), first subparagraph, letters c) and e), Article 6(3) and Article 9(1) of the GDPR, as well as Article 7 and Article 8(1) of the Charter of Fundamental Rights, also insofar as they relate to the collection and disclosure in electronic form of personal data relating to current or former membership in an association or functions performed or held in the past in such an association or in a foundation not conducting commercial activities (recital 384 of the judgment).

" Therefore, the Supreme Administrative Court, as a European court, is obligated to take into account the judgment of the Court of Justice of the EU in its ruling to the extent that it ruled that a national legal act was incompatible with EU law. In the present case, given the Court of Justice of the EU's unequivocal recognition that the provisions of Article 258 TFEU apply. Article 88a of the Act on the System of Common Courts, Article 45 § 3 of the Act on the Supreme Court in its amended wording and Article 8 § 2 of the Act on the System of Administrative Courts infringe the right to privacy set out in Article 7 of the Charter of Fundamental Rights and the right to the protection of personal data enshrined in Article 8 of the Charter of Fundamental Rights, as well as Article 6 sec. 1 sec. c and e of the GDPR specifying the grounds legalizing the processing of personal data, which the authority invoked when issuing the contested decision of 6 April 2020, no.