Sole Traders’ Register Data Is Personal Data: Bisnode Polska (UODO, PLN 943.470)
Background
The company sold commercial reports and other business information. It took data from public sources, including the Central Registration and Information on Business (CEIDG), the REGON database and the National Court Register (KRS). Its database held data on about 3.6 million people currently running or having suspended a sole-trader business and about 2.3 million who had run one in the past. In total it held nearly 7.6 million records about natural persons, including sole traders and the shareholders and board members of companies, foundations and associations (decision, findings 1–3 and 8).
For sole traders, the data included their name, business name, registered and other addresses, activity code (PKD), and where available phone number, email address and website (decision, reasoning on the data processed). Before the GDPR applied, on 27 April 2018, the company emailed an information notice to every sole trader for whom it held an email address. It also published a full notice on its website. It decided not to write to the rest by post or SMS because of the cost, which it estimated at over PLN 33.749.175 for registered post (findings 5–8).
The Authority’s Findings
People behind the businesses. The proceedings concerned natural persons conducting business activity: sole traders who were active, had suspended their business, or had closed it. The company had met its Article 14 duty only for the people it had emailed, about 682 thousand of them, and had not met it for the others (decision, reasoning).
A website notice was not enough. Publishing the Article 14(1) and (2) information on the company’s website could not count as fulfilling the duty where the company held the postal addresses, and sometimes phone numbers, of the sole traders concerned. The duty requires the controller to take active steps towards each person, although it may choose how (decision, reasoning; Art. 12(1)).
No disproportionate effort. Writing to people whose addresses the company already held was neither impossible nor a disproportionate effort under Article 14(5)(b). The UODO contrasted this with company shareholders and board members: the court register does not contain their contact details, so the company would have had to look for them elsewhere, which could be a disproportionate effort (decision, reasoning).
An intentional breach. The UODO found the company had consciously decided not to inform people because of the cost, affecting about 6.7 million records, and that the breach was continuing. It treated the attempt to justify this by the threat to the company’s finances as an aggravating factor (decision, Art. 83(2) assessment, points 1–3 and 12). It ordered the company to inform the remaining sole traders within three months.
Timeline
Amber marks the decisive decision or ruling.
| Date | Who | Action |
|---|---|---|
| Sep 2018 | UODO | Inspects the company (exact days redacted in the decision) |
| Jan 2019 | UODO | Opens administrative proceedings (exact day redacted) |
| 15 Mar 2019 | President of the UODO | Fines the company PLN 943.470 and orders it to inform sole traders within three months |
| 11 Dec 2019 | Voivodeship Administrative Court, Warsaw | Upholds the duty for active and suspended sole traders; annuls the order for former sole traders and the fine (II SA/Wa 1030/19) |
| 19 Sep 2023 | Supreme Administrative Court | Dismisses the company’s cassation appeal (III OSK 2538/21) |
The inspection and the opening of proceedings are plotted at the start and middle of their months because the days are redacted. The date of the Warsaw court judgment is from prawo.pl; the other court details are from the UODO.
The Outcome
The company appealed. The Voivodeship Administrative Court in Warsaw held that it had to inform people who were running or had suspended their business when the decision was issued. It annulled the order in so far as it covered people who had run a business only in the past, and because the number of people affected had influenced the size of the fine, it annulled the fine as well (UODO, 2023).
On 19 September 2023 the Supreme Administrative Court dismissed the company’s cassation appeal, confirming that it had to inform the sole traders whose data it held. It said exceptions to transparency, including “disproportionate effort”, must be interpreted restrictively. According to the UODO’s announcement, the authority must now reconsider the case for former sole traders and the amount of the fine (UODO, 2023).
What Could Have Been Done Differently
The company already had postal addresses for the sole traders in its database, and phone numbers for some. It could have written to them or sent SMS messages, as the UODO said, rather than relying on a website notice. The UODO also expected a professional data business to build the cost of compliance into its business model, rather than weigh it against people’s right to know their data were being used (decision, Art. 83(2) point 12 and the paragraph that follows).
A sole trader’s business record is still a person’s record. Taking it from a public register doesn’t remove the duty to tell them, and cost alone doesn’t make telling them a disproportionate effort.
Frequently Asked Questions
Is data about a sole trader’s business personal data?
In this case the UODO treated sole traders’ names, business names, registered addresses and activity codes as personal data of the natural persons running those businesses, and required Article 14 information to be given to them.
Is a privacy notice on a website enough when data come from public registers?
Not where the controller holds people’s postal addresses or phone numbers. The UODO found that the duty requires active steps towards each person, and the courts upheld the duty for people still trading or with suspended businesses.
Was the PLN 943.470 fine upheld?
No. The Warsaw court annulled the fine because it had been calculated partly on people who had only traded in the past. The duty to inform current and suspended sole traders was upheld up to the Supreme Administrative Court, and the UODO must reconsider the fine.
Business databases often mix company data with data about the people behind small businesses. Knowing which records identify people, and where they came from, is the starting point for Article 14.