Full text
Judgment Date 2026-05-28 Final Judgment Date of Receipt 2025-12-22 Court Supreme Administrative Court Judges Maciej Kobak /rapporteur/ Mirosław Wincenciak /chairman/ Przemysław Szustakiewicz Symbol with description 647 Cases related to personal data protection Thematic entries Access to public information Related references II SA/Wa 121/25 - Judgment of the Regional Administrative Court in Warsaw of 2025-08-27 Accused Authority Inspector General for Personal Data Protection Content of the Result Caslation appeal dismissed Referenced provisions Journal of Laws 2026, item 143, art. 184 Act of August 30, 2002, the Code of Administrative Court Procedure Summary The Supreme Administrative Court, composed of: Presiding Judge: Mirosław Wincenciak, Judge of the Supreme Administrative Court; Judges: Przemysław Szustakiewicz, Judge of the Provincial Administrative Court; Maciej Kobak (rapporteur); Clerk of the Court: Assistant Judge Marita Sukiennik-Sikora, having considered on May 28, 2026, at the hearing in the General Administrative Chamber, the cassation appeal of the City and Commune of O. against the judgment of the Provincial Administrative Court in Warsaw of August 27, 2025, file ref. Case No. II SA/Wa 121/25, regarding the complaint of the City and Commune of O. against the decision of the President of the Personal Data Protection Office of September 22, 2020, No. ZSZZS.440.392.2019.ZS.JM, regarding the issuance of a warning. I. dismisses the cassation appeal; II. awards the City and Commune of O. the amount of PLN 360 (three hundred sixty) from the City and Commune of O. to the President of the Personal Data Protection Office as reimbursement of the costs of the cassation proceedings. Justification By its judgment of August 27, 2025 (II SA/Wa 121/25), the Provincial Administrative Court in Warsaw, pursuant to Article 151 of the Act of August 30, 2002 - The Code of Administrative Court Procedure (Journal of Laws of 2024, item 935, as amended; hereinafter also referred to as "p.p.s.a.") dismissed the complaint of the City and Commune of O. against the decision of the President of the Personal Data Protection Office (hereinafter also referred to as the "President of the Personal Data Protection Office") of September 22, 2020, regarding the issuance of a warning. This decision was issued based on the following circumstances of the case. As a result of R. S.'s complaint (hereinafter also referred to as the "participant") regarding the processing of his personal data by the Mayor of the City and Commune of O. (hereinafter also referred to as the "Mayor"), regarding his Facebook login details and data associated with his profile on that website, administrative proceedings were initiated by the President of the Personal Data Protection Office, who, by decision of September 22, 2020, issued pursuant to Art. Pursuant to Article 104 § 1 of the Act of 14 June 1960 – the Code of Administrative Procedure, and Article 5 paragraph 1 letter a, Article 6 paragraph 1, Article 9 paragraph 2, and Article 58 paragraph 2 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU, L 119, 4 May 2016; hereinafter also referred to as the "GDPR"), the Mayor was issued a warning in point 1 for the violation of Article 5 paragraph 1, Article 6 paragraph 1, and Article 9 paragraph 1 of the GDPR, consisting in the unjustified acquisition of the participant's personal data contained in correspondence conducted by him via the social networking site Facebook; in point 2, however, he refused to grant the request in the remaining respects. During the course of the administrative proceedings, it was determined that: - the participant was employed at the City and Commune Office in O. (hereinafter also referred to as the "Office") as an IT specialist. On December 31, 2018, his employment contract was terminated with a three-month notice period. He was entrusted with a computer to perform his duties and was required to return it by January 3, 2019. - the participant failed to delete the bookmark and password synchronization account from his work computer and remained logged in to his individual Facebook account (see complaint of July 3, 2019). - in May 2019, another employee of the Office, hereinafter referred to as the "employee," was preparing the computer previously used by the participant for transfer to another person. After launching the internet browser on the computer in question, he was shown two conversations on Facebook with other Office employees, namely A. G. and J. Ż., hereinafter referred to as "employee II"; They concerned A. P., the Mayor. Due to their subject matter, the employee printed out the conversations in question – from November 2018 to May 2019 – and forwarded them to the Mayor (see: Mayor's explanation of March 26, 2020). - The Mayor used the data obtained from the correspondence to initiate disciplinary proceedings against employee II and criminal proceedings – against the same person and the participant (see: Mayor's explanation of March 26, 2020). - There was no employee monitoring at the Office (see: Mayor's explanation of March 26, 2020). Referring to Article 4(1) of the GDPR, the authority determined that the participant's correspondence could constitute personal data. The information contained in the correspondence allowed for the identification of its participants, including the person filing the complaint with the Office for Personal Data Protection. The authority found that it contained ordinary data (the processing of which is regulated by Article 6(1) of the GDPR) and special categories of data—e.g., information about the participant's religion—and that their processing is—in principle, in accordance with Article 9(1) of the GDPR—prohibited unless one of the grounds listed in Article 9(2) of the GDPR is met. Furthermore, Article 5(1) of the GDPR imposes on the controller an obligation to ensure lawful data processing (Article 5(1)(a)) and to ensure purpose limitation by collecting data for specific and legitimate purposes (Article 5(1)(b)). In the authority's opinion, there was no reason for the controller to obtain the participant's personal data in this case. Consequently, the authority found that the acquisition of the participant's personal data violated personal data protection regulations, and for this reason, the controller was issued a warning. However, the authority found no grounds for exercising its remedial powers – regarding the administrator's deletion of the participant's personal data, as they are being processed in connection with ongoing disciplinary and court proceedings. The Mayor appealed against the authority's decision to the Administrative Court, requesting that point 1 be set aside. By judgment of May 6, 2021 (II SA/Wa 2372/20), the Regional Administrative Court in Warsaw, pursuant to Article 145 § 1 item 1 letter a and § 3 and Article 200 of the Law on Proceedings Against Administrative Courts, set aside the appealed decision in point 1; in point 2, it discontinued the proceedings conducted by the Personal Data Protection Office (PUODO), and in point 3 of the operative part of the judgment, ordered the authority to reimburse the complainant for the costs of the proceedings. By its judgment of 16 January 2025 (III OSK 6135/21), the Supreme Administrative Court, after considering the PUODO's cassation appeal, set aside the above judgment and remanded the case to the Court of First Instance for reconsideration. In its justification, the Supreme Administrative Court indicated that, according to Article 2 paragraph 1 of the GDPR, the regulation applies to the processing of personal data wholly or partly by automated means, and to the processing other than by automated means of personal data that form part of a data filing system or are intended to form part of a data filing system. In turn, in accordance with the legal definition set out in Article Under Article 4(2) of the GDPR, "processing" means an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Under Article 4(6) of the GDPR, a "data filing system" means a structured set of personal data accessible according to specific criteria, regardless of whether the set is centralized, decentralized, or functionally or geographically dispersed. The court of first instance found that since accessing a participant's private correspondence via a specific online platform, the accessing of its content by an Office employee, and its subsequent copying and use, occurred, in its opinion, as a result of an unlawful interference with the data subject's right to privacy, including a breach of the confidentiality of correspondence. The injured party has the right to pursue appropriate claims against the perpetrator of the violation, which cannot be resolved by an administrative authority. In the Supreme Administrative Court's opinion, however, the Court of Appeals refrained from assessing whether the participant's personal data, including login credentials and other data to which the Mayor had access after logging in, had been collected. The court of first instance also ignored the fact that the GDPR, in its Article 13 provision, stipulates that Article 4, point 1 contains a broad definition of personal data, combining it with all information (and not just data) about an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. Therefore, the login data allowed access to the profile of a specific natural person (by identifying them) and enabled viewing, collecting, downloading, and using not only their data, but also the data of other people, given that logging in allowed viewing the entire content of recorded conversations (including personal data) in the application linked to the Facebook account, i.e., the Messenger application/communicator. The Regional Administrative Court in Warsaw did not make any assessment in this respect. It assumed that the subject of the decision was the issue of a breach of privacy – the secrecy of correspondence – which is protected court as a personal right and thus did not pay attention to the fact that the case concerned a narrower subject, i.e. the processing of personal data itself, which only partially fall within the concept of secrecy of correspondence and as such - a narrower subject - were assigned to the competence of PUODO. According to the Supreme Administrative Court, the court a quo also ignored a circumstance crucial to the case's resolution – from the perspective of its subject matter within the meaning of Article 2, Section 1 of the GDPR – namely, the moment of first data processing (use), i.e., the moment of logging into Facebook. In other words, the moment of using the participant's data, which allowed for the further processing of their personal data and the data of other individuals. The court of first instance also incorrectly interpreted Article 4, Section 6 of the GDPR. In this respect, it prematurely found that the case did not involve a personal data file, nor did it involve "events related to information processing (collection, transfer, etc.) where it is possible to mechanically retrieve information about individuals – their personal data – in particular within IT systems." The Supreme Administrative Court failed to assess whether the authority properly determined whether the processing of personal data was at least partially automated in this case, simply because the processing on the Facebook account and the related Messenger application is carried out using electronic devices (in this case, a computer), and both the account and the Messenger application record data (e.g., contacts, location, personal data contained in conversations), including the possibility of later retrieval (see https://www.messenger.com/help, https://www.facebook.com/help?locale=pl_PL and the detailed information posted on these websites by the operator regarding the method of data processing, along with a description of the individual functions of the account and Messenger). The Supreme Administrative Court also pointed out that the justification of the appealed judgment does not indicate that the court of first instance assessed the significance of the printouts from the Facebook account in light of the prior processing of personal data in electronic and automated form (i.e., processing from the moment of using the Facebook account login details). It did not determine whether the subsequent recording of these data in paper form had any impact on the use of the participant's personal data, which only subsequently provided such an opportunity (it did not determine whether subsequent processing of personal data other than by automated means excluded the case from the scope of the GDPR specified in Article 2(1) in principle – processing of personal data in a wholly or partially automated manner – and whether establishing the existence of a data filing system was therefore necessary at all). In this situation, without the above findings required by the hypothesis of the norm arising from Article 2(1) of the GDPR and as part of the assessment of the legality of the contested decision, the Regional Administrative Court in Warsaw could not find that the case fell outside the jurisdiction of the authority referred to in Article 58(2)(b) of the GDPR, and consequently also in Article 1(1) and Article 60 of the Personal Data Protection Act. The adequacy of the supervisory measure applied by the supervisory authority is assessed at a later stage, after its jurisdiction in the case has been determined. The Supreme Administrative Court also noted that such a cursory assessment of the authority's jurisdiction could exclude the possibility of sensitive data protection authorities conducting inspections, referred to in Article 9 paragraph 1 of the GDPR, and, as is apparent from the case files and the content of the administrative act appealed to the Court of First Instance, such data could also have been collected in the case. Therefore, each time an incriminated decision concerning the processing of personal data is reviewed, it should be determined beyond any doubt whether the case falls within the scope specified in Article 2 paragraph 1 of the GDPR (Article 1 paragraph 1 of the Personal Data Protection Act), while simultaneously applying all provisions related to the content of the aforementioned provision, in particular the provisions containing the legal definitions of Article 4 paragraphs 1, 2, and 6 of the GDPR, taking into account their correct application to the specific factual circumstances of the case (correct subsumption). Therefore, in this case, while the objections of the cassation appeal were bound, the Court of First Instance erroneously applied both the provisions of Article 2 paragraph 1 and the provisions of Article 4 point 6 of the GDPR, which also led to a violation of other provisions raised in the cassation appeal – including the provisions of the Personal Data Protection Act. Re-examining the case, the Court of First Instance found no grounds to uphold the Mayor's complaint. It noted that the Provincial Administrative Court was bound by the judgment previously issued by the Supreme Administrative Court on January 16, 2025 (III OSK 6135/21) and the assessments made therein, limiting the court's jurisdiction to the interpretation of the law provided by the Supreme Administrative Court in this case (Article 190 of the Personal Data Protection Act). In the court's opinion, the evidence collected confirms that the participant's personal data was collected in the case, in the form of both login credentials and other data to which the Mayor had access after logging in. The Mayor used the participant's login credentials, which were saved in the internet browser on the computer he had left behind, thus providing access to the remaining data in his profile, which the authority had collected (obtained) at least in part. The login details allowed access to a specific individual's profile (identifying them) and enabled the viewing, collection, downloading, and use of not only their data but also the data of other individuals, given that logging in allowed viewing the entire content of recorded conversations (including personal data) in the application linked to the Facebook account, namely the Messenger application/message. In this case, the data thus obtained was also further recorded in paper form. The mayor produced printouts of conversations from the participant's Facebook Messenger account between the participant and other City Hall employees. According to the court, in light of the aforementioned definition of "data filing system," there can be no doubt that the participant's personal data was collected in this manner and that this data, contained in correspondence with other Office employees on a social media platform, constituted a data set. This undoubtedly constitutes information about an identified natural person within the meaning of Article 4(1) of the GDPR. This information is also structured and accessible according to specific criteria, and therefore divided and assigned to identifiers such as: profile usernames, information contained in user conversations, and dates. In the court's opinion, since the Mayor collected and processed the participant's personal data, it is undisputed that the President of the Personal Data Protection Office (UODO) remains competent in this matter. It cannot be overlooked that the EU legislature, in Articles 77 and 79 of the GDPR, provided two avenues for legal protection in the event of a data protection breach: the right to lodge a complaint with a supervisory authority and the right to an effective judicial remedy against the controller or processor. Consequently, the Court interpreted the provisions of the GDPR cited by the Court, it reached the following conclusions: to be convinced of the correctness of the PUODO's assessment that there are no grounds to conclude that the participant's personal data were obtained by the controller in a manner consistent with personal data protection regulations. Therefore, it was appropriate to impose a warning on the Mayor under Article 58 paragraph 2 letter b of the GDPR, which is the most lenient penalty, and therefore the contested decision is lawful. The court did not find any violation of substantive law to the extent affecting the outcome of the case, or of a procedural provision to the extent that could have a significant impact on the resolution, or of a legal provision providing grounds for reopening the proceedings or declaring the decision invalid. The authority correctly determined the factual circumstances of the case, sufficiently collected and assessed the evidence, and then convincingly justified its decision. The administrative proceedings were conducted in accordance with the general principles of the Code of Administrative Procedure, in particular Article 7, Article 77 § 1, Article 80, and Article 107 § 3 of the Code of Administrative Procedure, and the contested decision The decision was based on the correct interpretation of substantive law. In his cassation appeal, challenging the judgment of the Provincial Administrative Court in its entirety, the Mayor alleged violations of the following provisions of substantive law: 1. Article 1, paragraph 1, and Article 60 of the Personal Data Protection Act of 10 May 2018, in conjunction with Article 2, paragraph 1, and Article 4, points 3 and 6 of the GDPR, through its incorrect interpretation and the adoption of an expansive interpretation of the protection arising from the GDPR Regulation, whereas the GDPR applies to events related to information processing where it is possible to mechanically retrieve information about individuals, particularly in IT systems. However, it does not apply to events related to the disclosure of personal data in other situations—namely, in the situation covered by this case, where the content of electronic correspondence was accessed; 2. Article 4, point 2 of the GDPR, through its incorrect interpretation and the assumption that in this case, personal data in the form of so-called login data and other data for personal data processing occurred. which the Mayor had access to after logging in, while the participant left his login details on his work computer and the Mayor did not search for them for processing; 3. Article 1 paragraph 1, Article 2 paragraph 1, and Article 4 point 6 of the GDPR through its incorrect interpretation and misapplication consisting in assuming that the provisions of the GDPR apply in this case, while the information contained in the participant's correspondence was not processed in a fully or partially automated manner; 4. Article 4 point 6 of the GDPR through its incorrect interpretation and misapplication consisting in considering that the participant's correspondence, which appeared automatically after opening the browser window, constituted a data set; 5. Article 6 paragraph 1 of the GDPR through its incorrect application and assuming that there were no grounds for legalizing the processing of personal data, while in this case, processing in accordance with the provisions of the GDPR did not take place; 6. Article 6 paragraph 1 of the GDPR through its incorrect application and assuming that the ground specified in this provision did not apply in this case, while Article 6 paragraph 1 point d indicates the need to protect the vital interests of the data subject. Based on the above allegations, which were further developed in the justification of the cassation appeal, the Mayor requested that the appealed judgment be set aside in its entirety and the complaint be upheld if the substance of the case is sufficiently clarified, or that the judgment be set aside in its entirety and the case be remanded for reconsideration if the substance of the case is not sufficiently clarified, while also requesting that the authority be ordered to reimburse the costs of the court proceedings. Furthermore, in a further letter, the cassation appeal complainant requested that the case be heard at a hearing. In response to the cassation appeal, the President of the Personal Data Protection Office requested its dismissal, upholding his previous position. The Supreme Administrative Court considered the following: Pursuant to Article 183 § 1 of the Law on Proceedings Before Administrative Courts, the Supreme Administrative Court shall consider the case within the limits of the filed cassation appeal, taking into account ex officio only the invalidity of the proceedings. In the case at hand, none of the circumstances resulting in the invalidity of the proceedings, as referred to in Article 183 § 1 of the Law on Proceedings Before Administrative Courts, apply. 183 § 2 of the Law on Proceedings Before Administrative Courts, or any of the grounds listed in Article 189 of the Law on Proceedings Before Administrative Courts, considered by the Supreme Administrative Court ex officio when reviewing the judgment appealed against in the cassation appeal. Therefore, the grounds for the legal defect of the appealed judgment, as indicated in the cassation appeal, determine the scope of review conducted by the Supreme Administrative Court, which, unlike the Court of First Instance, does not review the entirety of the case but only verifies the validity of the allegations raised in the cassation appeal. The cassation appeal is unfounded and, as such, must be dismissed. First, it should be recalled that the appealed judgment of the Court of First Instance was issued under Article 190 of the Law on Proceedings Before Administrative Courts. Pursuant to that provision, the court to which the case was referred is bound by the interpretation of the law provided in this case by the Supreme Administrative Court. A cassation appeal against a ruling issued after a retrial cannot be based on grounds inconsistent with the interpretation of the law established in this case by the Supreme Administrative Court. In reversing the judgment of the Provincial Administrative Court of May 6, 2021, file reference II SA/Wa 2372/20, by its judgment of January 16, 2025, file reference III OSK 6135/21, the Supreme Administrative Court noted that the Court of First Instance had failed to assess whether the participant's personal data had been collected, in the form of both login credentials and other data to which the Mayor had access after logging in. It is undisputed in this case that, by using the participant's login credentials, which were saved in the internet browser on the computer he left behind, access was gained to other data on his profile, which the authority also collected (obtained), at least in part. The login details allowed access to a specific individual's profile (identifying them) and enabled the viewing, collection, downloading, and use of not only their data, but also the data of other individuals, given that logging in allowed viewing the entire content of recorded conversations (including personal data) in the application linked to the Facebook account, i.e., the Messenger application/communicator. The Supreme Administrative Court indicated that in such a situation, the case may concern the processing of personal data, and not—as the Provincial Administrative Court found—solely a breach of the confidentiality of correspondence. The Supreme Administrative Court also emphasized that, from the perspective of Article 2(1) of the GDPR, the moment of first data processing (use) was not properly assessed, i.e., the moment of logging into Facebook. In other words, the moment of using the participant's data, which allowed for the further processing of their personal data and the data of other individuals. It was further pointed out that, in the context of the provisions of Article 4 point 6 of the GDPR, it was not considered whether the authority had properly established that the processing of personal data was at least partially automated in the case, if only because the processing on the Facebook account and the associated Messenger is carried out using electronic devices (in this case, a computer), and both the account and the Messenger store computer-based data (e.g., contacts, location, personal data contained in the content of conversations), also with the possibility of later retrieval (cf. https://www.messenger.com/help, https://www.facebook.com/help?locale=pl_PL and the detailed information provided on these pages by the operator on how the data is processed, together with a description of the individual functions of the account and Messenger). The significance of the printouts made from the Facebook account was also not duly considered in the light of the prior processing of personal data in electronic and automated form (i.e., processing from the moment the Facebook account login details are used). The Regional Administrative Court did not determine whether the further recording of these data in paper form had any impact on the use of the participant's personal data, which only subsequently enabled such use (it did not determine whether subsequent processing of personal data other than by automated means excluded the case from the scope of the GDPR specified in Article 2, paragraph 1 in principle – processing of personal data in a wholly or partially automated manner – and whether determining the existence of a data filing system was therefore necessary at all). Considering the assumed scope of the First Instance Court's binding interpretation of the law provided by the Supreme Administrative Court in its judgment of January 16, 2025, III OSK 6135/21, it cannot be assumed that the allegations raised in the cassation appeal are justified. As part of the allegation of violation of Article 1, paragraph 1 and Article 60 of the Personal Data Protection Act of May 10, 2018, in conjunction with Article 2, paragraph 1, Article 4, paragraphs 1 and 2, and Article 4, paragraphs 1 and 2, of the Personal Data Protection Act of May 10, 2018, in conjunction with Article 2, paragraph 1, ... Under Articles 3 and 6 of the GDPR, the appellant invokes the legal assessments expressed by the Regional Administrative Court in its judgment of May 6, 2021, file reference II SA/Wa 2372/20. The judgment in question was set aside precisely because the legal assessments cited therein were incorrect or at least premature. The appellant in the cassation appeal claims that personal data was not processed in this case, but only disclosed. On the one hand, he explicitly admits that private data was stored on the employee's computer, but on the other, he emphasizes that no such data was processed. According to the appellant in the cassation appeal, the employee's private account was displayed automatically because he left his login details on it. Regarding this issue, it should be noted, firstly, that when the employee returned the company computer, the appellant in the cassation appeal was obliged to verify its content and delete all personal data of the former employee before transferring it to another employee, so that the employee who subsequently used it would not have access to it. Secondly, the mere fact of leaving the Facebook login details behind did not, per se, reveal all other (remaining) information on that website and its associated Messenger account. By accessing the login details, the applicant gained access to further data, which, given the identifiable nature of the individuals concerned, constituted personal data. The applicant's claims that simply launching the computer and browser automatically revealed the employee's conversations with other employees from November 2018 to May 2019 on the screen were not supported by the case file. The court of first instance correctly stated that the applicant had used the participant's login details, which had been saved in the internet browser on the computer he left behind, thus providing access to the remaining data on his profile, which the authority had collected (obtained) at least in part. The login data allowed access to a specific individual's profile (and thus identified them) and enabled the viewing, collection, downloading, and use of not only their data but also the data of other individuals, given that logging in allowed the viewing of the entire content of recorded conversations (including personal data) in the application linked to the Facebook account, i.e., Messenger. This data constitutes personal data within the meaning of Article 4(1) of the GDPR. According to this provision, "personal data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. By collecting/acquiring/viewing this data, as well as by printing and using some of it, personal data were undoubtedly processed within the meaning of Article 4(2) of the GDPR. According to this provision, "processing" means an operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction. For this reason, the allegation of a violation of Article 4(2) of the GDPR was not upheld. The cassation appeal completely failed to address the assessment, approved by the Regional Administrative Court, that at least partial automation of personal data processing was possible in this case, as processing on the Facebook account and the related Messenger is carried out using electronic devices (in this case, a computer), and both the account and the Messenger store computer data (e.g., contacts, location, personal data contained in conversations), also with the possibility of later retrieval (see https://www.messenger.com/help, https://www.facebook.com/help?locale=pl_PL and the detailed information posted on these websites by the operator regarding the method of data processing, along with a description of the individual functions of the account and Messenger). Therefore, the argument raised in the cassation appeal that the processing was mechanical in nature cannot produce the expected procedural effects – an allegation of violation of Art. 1 sec. 1, Art. 2 sec. 1, Art. 4 item 6 of the GDPR. It is also impossible to agree that the circumstances of the case did not provide a basis for applying the provisions of the GDPR, as the conditions of Article 2(1) of the GDPR were not met. As stated in that provision, the regulation applies to the processing of personal data wholly or partly by automated means, and to the processing other than by automated means of personal data that form part of a data filing system or are intended to form part of a data filing system. The term "data filing system" in Article 2(1) of the GDPR, through its use of the term "data filing system," is closely linked to Article 4(6) of the GDPR, in which the European legislator provided a legal definition of this very concept. Under Article 4(6) of the GDPR, a "data filing system" means a structured set of personal data accessible according to specific criteria, regardless of whether the set is centralized, decentralized, or functionally or geographically dispersed. In the circumstances of this case, since the appellant did not dispute that at least partially automated processing of personal data took place, the issue of including them in a "data filing system" is irrelevant, as partially automated processing of personal data, regardless of whether they are included in a data filing system, always triggers the application of the provisions of the GDPR – Article 2(1) of the GDPR. For the reasons outlined, the allegations of violation of Article 4(6) and Article 6(1) of the GDPR were also subject to negative verification. Considering all the above, the Supreme Administrative Court dismissed the cassation appeal pursuant to Article 184 of the Law on Proceedings before Administrative Courts. The costs of the cassation proceedings were determined pursuant to Article 204(1) and Article 205(2) of the Law on Proceedings before Administrative Courts.