The Polish data protection authority (UODO) has issued a warning to two parliamentarians for failing to cooperate with its investigation, illustrating that the obligation to provide information to the supervisory authority applies to everyone, and that cooperation, even if late, can help avoid a financial penalty.

Facts and context

The Polish data protection authority (UODO) today published a decision issuing a warning to parliamentarians Waldemar Buda and Michał Woś for failing to comply with their obligation to cooperate with the supervisory authority.

The case originated from reports received by the UODO concerning the alleged disclosure of personal data of an individual on social networks by the two parliamentarians during the 2025 presidential campaign.

Grounds for the decision

• Obligation to cooperate with the supervisory authority (Article 58 of the GDPR): After opening an investigation based on the reports, the authority sent information requests twice to each parliamentarian to clarify the circumstances of the disclosure. They provided no response, with letters either ignored or returned to sender marked "not claimed within the deadline." The authority considered this lack of response a failure to provide access to the information necessary for the performance of its tasks, effectively preventing it from investigating the initial case.

Decision of the authority

Consequently, the authority issued a warning to Waldemar Buda and Michał Woś.

Lessons learned

This decision reminds that:

• The obligation to cooperate with the supervisory authority is an autonomous obligation, non-compliance with which may be subject to a sanction procedure separate from that concerning the initial infringement.
• Cooperation with the authority, even if late, is an essential mitigating factor that can lead to a reduction of the sanction, or even its replacement by a corrective measure such as a warning.
• Remedying the infringement (in this case, providing the requested information) as soon as a financial sanction procedure is notified is taken into account by the authority in determining the nature of the final measure.