GDPR on the bus: The bus driver demanded from the passenger giving aloud name and surname. “It was not enough for him to show an electronic ticket. This way Passenger data met other people On the bus, and there were no grounds for this, “says the Office for Personal Data Protection (UODO).
WSA judgment: In the opinion of the President of UODO, the bus carrier collected personal data of passengers, selling their tickets by Internet. The driver then checked the passenger data with this list. The President of UODO gave the company admonitions. “This procedure is not appropriate and violates the provisions of the GDPR” – we read. The company appealed up to the Provincial Administrative Court (WSA) and won: The court annulled the decision The President of UODO, recognizing that he had no grounds for intervention, because “providing name and surname when buying a ticket, and then introducing himself aloud on the bus is not the processing of personal data within the meaning of the GDPR.”
Cassation complaint: The President of UODO did not agree the argument of the Provincial Administrative Court, and in the cassation complaint that both the GDPR and the Personal Data Protection Act stipulate that he is conducting the procedure for violating personal data as a supervisory body for data protection. “So the President of UODO He had not only the right, but also the obligation take care of the passenger's complaint. And fulfilled this obligation. In this case, it does not matter that personal data was processed in an uncomatased manner – by the driver. They were processed by him and revealed to unauthorized persons” – we read in a message.
Supreme Administrative Court judgment: The Supreme Administrative Court (NSA) agreed with the president of UODO. “The interpretation of the provisions on the protection of personal data used by the WSA is incorrect. The name is personal data that identifies man, and in the indicated case they were processed as part of the data set ” – the company was emphasized. The company created a data set, downloading data from customers when buying tickets.” If the driver checked them using this collection, It is as a representative of the administrator he processed and revealed them. Consequently, the legality of such sharing should be assessed by the President of UODO in connection with the complaint he received, “it was indicated.
Read also: “Revolution on the railway. One ticket for trains. A new solution is coming“.
Source: Uodo