Polish Data Watchdog Orders Deletion of Judges’ Disclosures, Reprimands Nearly 90 Officials

Poland’s data protection watchdog has reprimanded nearly 90 court presidents and heads of prosecution offices over the processing of judges’ and prosecutors’ personal information under the 2019 law commonly known as the “muzzle law”. The authority also ordered the deletion of data in declarations of membership of organisations and political parties.

Author/source: Poland’s Personal Data Protection Office (UODO). Polish original published on 10 November 2026 at 09:43:11 UTC.

The decisions by UODO President Mirosław Wróblewski follow rulings by the Court of Justice of the European Union (CJEU) and Poland’s Supreme Administrative Court questioning the legality of collecting and publishing the information. The provisions, introduced by legislation dated 20 December 2019, required judges and prosecutors to disclose membership of associations, foundations and political parties, among other organisations.

The declarations were to be published in the Public Information Bulletins of courts and prosecution offices, the online registers used by Polish public bodies. UODO concluded that an obligation imposed by national legislation was insufficient to justify such an extensive intrusion into privacy. The provisions failed the necessity and proportionality requirements of the EU’s General Data Protection Regulation (GDPR).

Taking declarations offline is not enough

Data controllers must do more than remove the declarations from websites. They must also stop further processing, including storage, of the information covered by the decisions.

Most courts and prosecution offices had already withdrawn the declarations from public access. Between July 2024 and October 2025, their management issued orders suspending publication or removing the documents from their Public Information Bulletins. The institutions nevertheless continued to hold the data.

UODO also found that individual declarations remained available, including in the Public Information Bulletins of the Supreme Court and the Ministry of Justice. The Supreme Administrative Court held that the problem extended beyond publication: collection and storage were also unlawful without an adequate legal basis.

UODO’s president was therefore required to issue a decision finding a breach of data protection rules and to apply corrective measures.

Disclosure requirements raised privacy concerns from the outset

The obligation was introduced as part of amendments to legislation governing the justice system. Judges and prosecutors were required to reveal membership of specified organisations, with the information then entering publicly accessible registers.

In 2019, Adam Bodnar, then Poland’s Commissioner for Human Rights, warned about the risks. Disclosure of membership of civic, charitable or political organisations could infringe the privacy of legal professionals. In some cases, organisational affiliations could indirectly reveal political views, religious beliefs, philosophical convictions or even sexual orientation.

The commissioner argued that mandatory disclosure went beyond what was necessary to achieve the stated objectives of transparency and political neutrality in the justice system.

EU court rejected the provisions in June 2023

A turning point was the CJEU’s judgment of 5 June 2023 in case C-204/21, concerning Poland’s failure to fulfil obligations under EU law. The court held that requiring judges to disclose organisational memberships and making that information public violated their rights to privacy and personal data protection.

It found the measures incompatible with Articles 7 and 8 of the Charter of Fundamental Rights of the European Union and with GDPR provisions, particularly those governing lawful processing and the protection of special categories of data.

The judgment was relevant to proceedings before Poland’s administrative courts. It confirmed that placing an obligation in national legislation is not sufficient where the provisions breach EU-law requirements.

UODO reversed its position after four years

The data-processing proceedings began on the authority’s own initiative following an intervention by the Commissioner for Human Rights. In April 2020, the then UODO president, Jan Nowak, discontinued them.

Nowak reasoned that because the duty to submit and publish declarations arose directly from legislation, processing had a legal basis under Article 6(1)(c) of the GDPR. The commissioner challenged that decision before the Regional Administrative Court and subsequently lodged a cassation appeal with the Supreme Administrative Court in 2021.

After becoming UODO president, Wróblewski changed the office’s position. In a submission to the Supreme Administrative Court dated 22 May 2024, he endorsed the commissioner’s arguments. National rules permitting data processing, he said, must pursue a legitimate objective and remain proportionate to it.

The 2019 legislation also failed to define precisely the purpose of collecting the data, the rules governing publication and the retention period.

Poland’s Supreme Administrative Court overturned the earlier decision

In 2025, the Supreme Administrative Court overturned UODO’s April 2020 decision and the earlier Regional Administrative Court judgment that had upheld it. The higher court found that the regulator had wrongly accepted a legal basis for collecting, processing and publishing information about judges’ and prosecutors’ membership of organisations and political parties.

The case consequently returned to UODO’s president. The authority was bound by the Supreme Administrative Court’s legal assessment and had to reconsider the infringements and issue corrective decisions.

A national statute must still meet GDPR requirements

The decision has implications beyond the justice system. A data controller, including a public institution, cannot justify processing solely by pointing to the formal existence of a provision in national law.

Under the GDPR, the legal basis must meet substantive requirements. Processing should serve a specific public-interest objective, be necessary to achieve it and be proportionate to the interference with the rights of the people concerned.

Information revealing political opinions, religious or philosophical beliefs and trade-union membership receives particular protection. Publishing data capable of revealing such information requires appropriate legal safeguards.

Those requirements were not met by the provisions introduced in 2019. The deletion obligation therefore also covers declarations that had already been removed from the internet but remained in the controllers’ possession.