The Polish Data Protection Authority (UODO) issued reprimands against nearly 90 court presidents and chief prosecutors for publishing data on the associative and political affiliations of judges and prosecutors, based on a national law deemed non-compliant with European Union law.

Facts and context

The Polish Data Protection Authority (UODO) today published a sanction decision against nearly 90 court presidents and chief prosecutors (including reprimands) for breaches related to the publication of personal data of judges and prosecutors.

The case began in 2019 following a report from the Polish Ombudsman, who drew UODO's attention to a new law, called the "gag law," requiring judges and prosecutors to declare their membership in associations, foundations, or political parties, and providing for the publication of these declarations in Public Information Bulletins.

Grounds for the decision

After an initial dismissal decision in 2020, annulled by the Supreme Administrative Court (NSA) following a ruling by the Court of Justice of the European Union (CJEU), UODO re-examined the case and found the following breaches:

• Requirement to have a valid legal basis for processing (Article 6 of the GDPR): The data controllers relied on a national legal obligation to justify the collection and publication of the data. However, UODO, in compliance with the CJEU ruling of 5 June 2023 (case C-204/21) and the subsequent NSA decision, found that the national law in question did not constitute a sufficient legal basis. Indeed, a national provision can only legitimize processing under Articles 6(1)(c) and (e) of the GDPR if it meets the qualitative criteria of Union law, notably the principles of proportionality and necessity, and serves a public interest objective. However, the law did not specify the purpose of the processing and publication, nor the data retention period, thus causing a disproportionate infringement on the right to privacy and data protection guaranteed by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union.
• Prohibition to process special categories of data (Article 9 of the GDPR): Information relating to membership in an association, foundation, or political party is likely to reveal the political opinions or philosophical convictions of the data subjects, thus constituting sensitive data within the meaning of Article 9 of the GDPR. The CJEU ruling explicitly found a violation of Article 9(1) of the GDPR. With the national legal basis deemed invalid, the processing of these special categories of data lacked any lawful condition. The NSA further specified that any form of processing of these data, including mere retention, was illegal.

Authority's decision

Consequently, the authority issued reprimands against the data controllers concerned.

Furthermore, the authority ordered the deletion of declarations still retained, even though their publication had already been suspended by the entities between July 2024 and October 2025.

Lessons learned

This decision recalls that:

• A national legal obligation constitutes a valid legal basis under Article 6 of the GDPR only if the law itself complies with Union law requirements, notably the principles of necessity and proportionality as well as the Charter of Fundamental Rights.
• A national legal provision authorizing data processing must be clear and precise regarding its purposes and must not excessively infringe on the rights and freedoms of data subjects.
• The invalidation of a legal basis by a higher court renders unlawful any processing operation based on it, including mere data retention, which must then be deleted.