UODO (Poland) - DS.523.2582.2024
How it connects
Full text
The DPA reprimanded a mayor for the unlawful disclosure of a data subject’s name and email address in connection with a request for access to public information. English Summary. Facts. The data subject requested the mayor of their place of residence (the controller) to provide them scans of contracts the city had concluded with certain companies and invoices issued to these companies in February 2024. In April 2024, the controller responded he did not possess the requested documents. This response contained the first and last name as well as the email address of the data subject and was forwarded to multiple recipients, including one of the companies the data subject’s request concerned. Following this, the data subject filed a complaint with the DPA. The controller argued it had processed the data subject’s personal data solely for responding to the request for access to public information. In addition, the controller was of the opinion that the processing had been necessary to fulfi