Polish Court Upholds UODO Reprimand of MP for Unlawful Disclosure of Personal Data

Key Takeaways

• On September 3, 2026, the Warsaw Voivodeship Administrative Court upheld the Polish data protection authority's October 2025 reprimand of a Sejm member who disclosed a resident's personal data during a live-streamed parliamentary inspection.
• The court found no legal basis for the disclosure and held that it was not necessary for the stated purpose.
• Compliance teams should treat this as confirmation that a legitimate public function does not override the necessity and data minimization requirements of data protection law.

Deep Dive

The court (case no. II SA/Wa 2548/25) confirmed the position of the President of the Personal Data Protection Office (UODO), Mirosław Wróblewski, in his decision of October 7, 2025. It found two defects: there was no legal basis for disclosing the data, and the MP's actions were not necessary for his declared purpose of conducting a parliamentary inspection. The MP disclosed data that clearly identified the individual during a live-streamed inspection of a former municipal flat, which infringed the person's right to privacy. The reasoning aligns with the GDPR principles of lawfulness, purpose limitation, and data minimization.

For compliance teams, the key point is that a legitimate mandate or public-interest function does not by itself justify disclosing personal data. The processing must still rest on a valid legal basis and be necessary and proportionate. UODO's reasoning that the MP could have exercised his mandate without compromising the data subject's privacy reflects a least-intrusive-means test. This test applies equally to financial institutions that disclose customer or employee data to regulators, auditors, litigants, media, or public forums under claims of legitimate interest or legal duty.

Only the oral reasons have been announced, so the written grounds are not yet available, and the judgment may be subject to appeal. The disclosure occurred during the 2025 presidential election campaign. The timing suggests regulators will not treat political or high-visibility settings as mitigating, and they may scrutinize them more closely. The sanction here was a reprimand, not a fine, but the ruling strengthens UODO's enforcement position for future cases and shows that its decisions are likely to withstand judicial review.

Recommended actions: - Review the legal basis documented for each external or public disclosure of personal data, and confirm that a necessity and proportionality assessment is on file. - Train staff, especially executives, public-facing personnel, and those who communicate with media or conduct recorded or streamed events, on redacting or anonymizing identifying details. - Update policies on livestreaming, recording, and social media use for events at which personal data could be exposed. - Monitor publication of the written reasons and any appeal, and reassess controls if the court elaborates on necessity.

Risk implications: The direct financial exposure in this case was limited, but the reputational and regulatory risks are significant. Under the GDPR, unlawful disclosure can also bring corrective measures, higher administrative fines, and claims for damages from data subjects in comparable cases. Organizations operating in Poland should expect continued active enforcement by UODO and judicial support for it.

Source: Poland Inspector General for Personal Data Protection (UODO)