The Supreme Administrative Court confirmed that withdrawal of consent cannot be impeded

The ClickOuickNow company will have to pay a fine imposed by the President of the Personal Data Protection Office. The Supreme Administrative Court has dismissed its cassation appeal against the verdict of the Voivodeship Administrative Court in Warsaw on a complaint against a decision in which the President of the Personal Data Protection Office imposed a fine of PLN 201,559.50 on it.

The judgement of the Supreme Administrative Court, which was delivered on 12 November 2024, is equal to the data controller having to pay the fine. The court, like the earlier Voivodeship Administrative Court in Warsaw, shared the position presented in the decision of the President of the Personal Data Protection Office of 16 October 2019 and the arguments of the supervisory authority about the legitimacy of the imposition of the penalty, as well as its amount.

The President of the Personal Data Protection Office’s decision to impose a fine was related to ClickOuickNow's breach of the General Data Protection Regulation. According to the President of the Personal Data Protection Office, the company obstructed the process of withdrawing consent to the processing of personal data by using complicated organisational and technical solutions when someone tried to withdraw such consent. Thus, it violated the principle that withdrawing consent should be as easy as giving it.

This was also confirmed by the Supreme Administrative Court, which noted in its oral reasoning for the judgment that the controller's use of a cross-reference (link), included in the content of the commercial information, did not result in the prompt revocation of consent and, in fact, the messages sent via the link were misleading to the person who wished to withdraw consent.

In justifying the judgment, the Supreme Administrative Court also pointed out that people who tried to withdraw their consent to the processing of personal data were misled. They received a message that read: ‘Your withdrawal of consent today 13.02.2019 !’, but, as the Court emphasised, the receipt of such a message did not at all mean the effective withdrawal of consent, but obliged the person to indicate the reason for the withdrawal of consent. However, the failure to indicate the reason interrupted the process of withdrawing consent. The Supreme Administrative Court also noted the scale of the phenomenon - as at 31 January 2019, the Company's database processed the personal data of more than 2.1 million individuals.

In the decision concerning ClickOuickNow, the President of the Personal Data Protection Office also found that the company processed without a legal basis the data of persons who were not its customers and from whom it had received requests to stop processing their personal data. In this way, the fined controller breached the exercise of the right to request the erasure of personal data.