Does The President Of The PDPO Have Jurisdiction To Examine Complaints Regarding The Processing Of Personal Data By Parliamentary Investigative Committee?

• Published date: 02 April 2024
• Subject Matter: Privacy, Data Protection
• Law Firm: Schoenherr Attorneys at Law
• Author: Piotr Podsiedlik

In the first half of March, the President of the Personal Data Protection Authority (PDPA) responded to the Minister for European Union Affairs on whether the judgment of the Court of Justice of the European Union (CJEU) of 16 January 2024 in Case C-33/22 'sterreichische Datenschutzbeh'rde will require relevant amendments to Polish law.

The facts of the aforementioned judgment were as follows. In 2018, an investigative committee was set up in Austria to investigate the possibility of political pressure on the Bundesamt für Verfassungsschutz und Terrorismusbek'mpfung, which was replaced on 1 December 2021 by the Direktion Staatsschutz und Nachrichtendienst (Directorate for State Security and Intelligence Services, Austria). In the course of its work, the investigation committee interviewed an officer of the Federal Police brigade for combating crime on public roads as a witness. Despite the witness's request to anonymise his data, the committee disclosed it. The witness therefore filed a complaint to the Austrian national data protection authority (the "Authority") regarding the disclosure of his data.

The Authority dismissed the complaint on the grounds that, according to the principle of the separation of powers, the executive (i.e. the Authority) cannot exercise control over the legislative authority, under which the investigation committee was subordinate.

The witness then challenged the Authority's decisions before the Federal Administrative Court, which upheld the complaint and cancelled the Authority's decision, indicating that the Authority was legally competent to hear the complaint under Article 77 of the GDPR...