Poland: Issued Supreme Administrative Court ruling upholding Personal Data Protection Office fine against Bisnode

On 20 September 2023, the Supreme Administrative Court of Poland upheld the decision of the Personal Data Protection Office, confirming that Bisnode, now Dun and Bradstreet, could be fined for failing to inform individuals about the processing of their personal data obtained from public registers. This case resulted in a fine of over PLN 943’000 against Bisnode. The Court emphasised the importance of transparency in data processing and the limited applicability of General Data Protection Regulation (GDPR) exceptions such as "disproportionate effort," requiring the Personal Data Protection Office to reassess certain aspects of the case.