The Supreme Administrative Court of Poland has confirmed a sanction by the Polish data protection authority (UODO), recalling that while oral consent for processing health data can be valid, it is the controller's responsibility under the accountability principle to demonstrate that such explicit consent was indeed obtained.

Facts and context

On October 6, 2026, the Supreme Administrative Court of Poland confirmed a decision by the Polish data protection authority (UODO) imposing a fine of 45,697 PLN (approximately €10,600) on the partners of the Pionier firm for processing health data without a valid legal basis.

The case began with an inspection request addressed to the UODO by the district Police Commander concerning the data processing practices of the firm's partners. Due to their lack of cooperation, the authority conducted an on-site inspection.

Reasons for the decision

The investigation revealed that the partners collected personal data, including health data, from potential clients via the internet, social media, and field surveys, even before any contract was concluded. The authority found several violations:

• Obligation to obtain explicit consent for processing health data (Article 9 of the GDPR): The controllers claimed to have obtained oral consent to process their potential clients' health data. However, the Court ruled that the mere fact that a prospect initiates a conversation or submits medical documents does not constitute the active and unambiguous manifestation of will required by the GDPR for explicit consent. The absence of complaint or opposition from the data subjects cannot be equated with consent either.

• Obligation to have a legal basis for processing (Article 6 of the GDPR): The argument that the processing was necessary for pre-contractual measures was rejected. The courts considered that collecting data solely to assess the profitability of a future contract or to ensure the client's willingness to contract does not fall under "pre-contractual measures taken at the request of the data subject." This processing was therefore deemed disproportionate and unnecessary.

• Obligation to demonstrate consent collection (Article 7(1) of the GDPR) and accountability principle (Article 5(2) of the GDPR): The Court recalled that although oral consent is admissible, the burden of proof for its obtaining lies entirely with the controller. The partners' general statements about their practice of requesting consent were insufficient, as they could not prove the date, content of the information provided, or the exact scope of consent for each person, especially regarding health data.

Authority's decision

Consequently, the authority imposed a fine of 45,697 PLN (approximately €10,600) on the partners of the Pionier firm.

Furthermore, the authority ordered the controllers to cease processing personal data collected without a legal basis.

Lessons learned

This decision reminds that:

• Oral consent, including for health data, is only valid if the controller can prove its existence, explicit nature, and scope, for example through a consent register or recordings of conversations.

• Data processing in the pre-contractual phase is lawful under Article 6(1)(b) of the GDPR only if carried out at the request of the data subject for the purpose of concluding a contract, and not to assess a business opportunity for the controller.

• Silence, absence of opposition, or the mere fact that a data subject initiates contact cannot be interpreted as valid and explicit consent within the meaning of Article 4(11) of the GDPR.