The Polish Civil Rights Defender (RPO) has joined a procedure before the Supreme Administrative Court to support the position of the President of the Office for Personal Data Protection (UODO) regarding the disclosure of personal data by the National Prosecutor's Office during a press conference.

The case began in 2023, when during a press conference, the National Prosecutor's Office disclosed personal data of a victim, including their name and health information, which fall under the special categories of data protected by Article 9, paragraph 1 of the GDPR. The UODO concluded a violation of the GDPR, finding that the disclosure had no legal basis, that the breach was not notified to the authority within 72 hours, nor to the data subject. An administrative fine of 85,000 zł was imposed on the National Prosecutor's Office, along with an order to notify the victim. The Prosecutor's Office challenged this decision, arguing that the disclosure was in accordance with the Prosecutor's Office Act and the directive on criminal matters, as it was within the scope of its duties.

The Warsaw Voivodeship Administrative Court (WSA) annulled the UODO decision, ruling that the authority was not competent as the incident fell under the Prosecutor's Office Act and not the GDPR, although it acknowledged that the data should not have been disclosed. The President of the UODO filed a cassation appeal, considering that the context of the conference, concerning personnel decisions and not an ongoing investigation, justified the application of the GDPR. The Civil Rights Defender supports this analysis, stating that the conference did not fall within the judicial missions of the prosecutor's office and that a broad interpretation of its powers would infringe fundamental rights guaranteed by the GDPR and the Polish Constitution. He emphasized that the public dissemination of such information aggravated the violation and the risk of secondary victimization.