NSA - III OSK 2508/25
Poland's Supreme Administrative Court rules mayor unlawfully processed personal data via Facebook.
Poland's Supreme Administrative Court has ruled that a city mayor unlawfully processed personal data by accessing a former employee's Facebook account. The mayor used private conversations from the account, accessed via the employee's work computer, to initiate disciplinary and criminal proceedings. The court affirmed that login credentials, profile information, and conversation content constitute personal data under GDPR.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Facebook?
Get an email when a new story names Facebook, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Polish city mayor accessed a former employee's personal Facebook account through their work computer, using private messages as evidence in disciplinary and criminal proceedings. Poland's Supreme Administrative Court ruled this constituted unlawful processing of personal data under GDPR, as login credentials, profile data, and private conversations all qualify as personal data. This case highlights the critical risk of privileged individuals abusing access to organisational devices to harvest personal information. It underscores that authority over workplace equipment does not grant legal rights to access employees' personal accounts or communications, and that GDPR protections extend to data encountered incidentally on work systems.
What helps against this
How we list vendors- Identity governance and single sign-on
People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.