Monitor Prawniczy

no. 23/2021

Relativisation of the notion of personal data in light of the jurisprudence of Polish administrative and common courts: On the need to ensure the cohesion and role of soft law in shaping the conceptual framework on the basis of the GDPR

Dominik Lubasz
Autor jest radcą prawnym, wspólnikiem zarządzającym w Lubasz i Wspólnicy – Kancelaria Radców Prawnych. Członek Rady Naukowej Centrum Ochrony Danych Osobowych Uniwersytetu Łódzkiego, SABI – Stowarzyszenia IOD, Compliance Institute oraz członek komisji rewizyjnej Stowarzyszenia Prawa Nowoczesnych Technologii, a także ekspert Izby Gospodarki Elektronicznej i Ministerstwa Cyfryzacji ds. wdrożenia RODO w Polsce, ekspert w Grupie Roboczej ds. Sztucznej Inteligencji przy Ministrze Cyfryzacji (KPRM) oraz członek grupy roboczej do spraw sztucznej inteligencji European Association of Data Protection Professionals. Współtwórca narzędzia do analizy ryzyka na podstawie RODO – GDPR Risk Tracker; ORCID: 0000-0001-9716-5802.
Adam Szkurłat
Autor jest adwokatem i liderem specjalizacji Ochrona Danych Osobowych w Lubasz i Wspólnicy – Kancelarii Radców Prawnych sp. k. Absolwent studiów podyplomowych „Wykonywanie funkcji inspektora ochrony danych” w Instytucie Nauk Prawnych Polskiej Akademii Nauk. Autor kilkudziesięciu publikacji z zakresu ochrony danych osobowych.
Abstract

The notion of personal data, although explicitly defined in Art. 4(1) of the GDPR, is sometimes interpreted in a way far from the original concept assuming, with a view to the purpose of the regulation, a broad attribution of the status of personal data to particular pieces of information. This kind of interpretation contradicts the legislator’s intention, which was to eliminate doubts and harmonise the applied notions. In practice, different views on the qualification of particular pieces of information as personal data have emerged, described as an objective and subjective conception. Especially the latter group of views seems to be recently more and more represented in the jurisprudence of Polish administrative and common courts.Court decisions passed in the last few years deny that such information as telephone numbers or number plates of vehicles have the value of personal data. Such tendencies in fact lead to relativisation of the notion of personal data in which subjective factors play an increasingly important role. There is no doubt that it is crucial for the uniform application of the GDPR provisions to work towards a uniform definition of personal data. An important role in this process can be played by the opinions and guidelines of the European Data Protection Board which, thanks to these tools, has the possibility to influence the jurisprudence and legal interpretation of personal data. The output of the EDPB’s predecessor, the Article 29 Working Party, can serve as a certain benchmark for the importance of such soft law. The opinions, guidelines and recommendations of the Working Party not only played an important law-making role, but also had a significant impact on the application of data protection legislation.