Cybersecurity Policy Report, Polish Agency Rejects Privacy Consultation With Lawyers’ Group, (Apr 21, 2026)

By Tony Foley

The Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO), has denied a request from a professional lawyers association for a prior consultation with the agency under article 36 of the European Union’s General Data Protection Regulation (GDPR), clarifying that only personal data controllers may request such consultations.

Background. UODO said in a press release yesterday that the leader of the Lawyers for Poland Association submitted a letter on April 10 raising concerns about the possible illegal processing of personal data by presidents of common courts and requesting that action be taken to prevent it. The matter at issue relates to upcoming elections of the judicial branch of the National Council of the Judiciary, in which the presidents of regional and appellate courts will convene general assemblies to elect these candidates.

In its letter, the Lawyers for Poland Association maintained that general assemblies were bodies of judicial self-government with strictly defined statutory powers but that no statute regulated these bodies’ participation in elections to the National Council of the Judiciary. As a result, the letter said, presidents of common courts had no legal basis for issuing opinions on candidates for the council, which also involves the processing of personal data. The letter asks for a prior consultation on the admissibility of processing personal data, including sensitive data like judges’ membership in associations, adding that the consultations should concern legitimate interests pursued by the controller.

UODO response. In a response, UODO President Mirosław Wróblewski responded that the lawyers’ association was not the data controller in this case and was not entitled to a consultation. "The prior consultation procedure was established by the EU legislator for the specific situations indicated in this provision, and—importantly—the initiation of this mechanism is intended to benefit the personal data controller and occurs solely at the controller's initiative,” President Wróblewski said.

The response from President Wróblewski, which may be downloaded from the press release but is available only in Polish, emphasized that a necessary condition for the validity of a request for prior consultation is that it be submitted by a controller who has previously conducted a data protection impact assessment of the planned action.

News: InternationalLegislation DataPrivacy GDPR