Traple Konarski Podrecki i Wspólnicy Sp.J

Traple Konarski Podrecki & Partners is one of the leading law firms on the Polish market, with a more than 20 years of experience. It is regularly ranked as one of the leaders in Poland in the following areas: IP, TMT, IT, new technologies, Fintech, data protection and competition and consumer protection laws. The law firm team is composed of more than 70 lawyers. It serves the biggest international and domestic companies, including ones listed on NYSE, Nasdaq, LSE and FSE. The law firm is an official legal expert of Polish IT and Telecommunications Chamber of Commerce, Internet Advertising Bureau Poland, Polish Chamber of Insurance and Polish Cashless Foundation. T: (+ 48) 22 850 10 10 E: office@traple.pl Web: www.traple.pl Xawery Konarski is Senior Partner at Traple Konarski Podrecki & Partners which is one of the leading law firms on the Polish market (20 years of experience, more than 70 lawyers). With a population of nearly 38.5 million people, Poland is the fifth most populous member state of the European Union, it has the sixth largest economy by GDP (nominal) in the EU. The Kingdom of Poland was founded in 1025, and in 1569 it cemented its longstanding political association with Lithuania by signing the Union of Lublin. This union formed the Polish–Lithuanian Commonwealth, one of the largest and most populous nations of 16th and 17th century Europe, with a uniquely liberal political system which adopted Europe's first written national constitution, the Constitution of 3 May 1791. Poland is a member state of the Schengen Area, the United Nations, NATO, the OECD, the Three Seas Initiative, the Visegrád Group, and guested at the G20. TKP serves the biggest international and domestic companies, including ones listed on NYSE, Nasdaq, LSE and FSE. The law firm is an official legal expert of Polish IT and Telecommunications Chamber of Commerce, Internet Advertising Bureau Poland, Polish Chamber of Insurance and Polish Cashless Foundation.

Representatives

Xawery Konarski

partner

Contact

Publications

• Polish Supreme Administrative Court Requires DPAs to Prove Identifiability Before Treating IP Addresses and Cookie IDs as Personal DataIn a significant judgment issued on 16 October 2025 (III OSK 2595/22), the Polish Supreme Administrative Court (NSA) held that the data protection authority (UODO) cannot assume that IP addresses and cookie identifiers always constitute personal data. Instead, the authority must demonstrate - based on objective, case-specific factors - that an individual is identifiable within the meaning of Article 4(1) GDPR. The ruling strengthens procedural rigor in GDPR enforcement and reinforces the contextual approach to identifiability reflected in CJEU case law, including Breyer and Planet49.9 December 2025
• Polish Supreme Administrative Court Upholds Employers' Right to Retain Rejected Applicants' Data for Defense Against Potential Discrimination ClaimsThe Polish Supreme Administrative Court issued a landmark ruling on February 20, 2024 case no III OSK 2700/22, affirming that employers can lawfully retain personal data of rejected job applicants based on their legitimate interest in defending against potential discrimination claims. This decision provides significant guidance on the interpretation of Article 6(1)(f) of the General Data Protection Regulation (GDPR) concerning the lawful grounds for processing personal data after the conclusion of a recruitment process.18 December 2024
• The Polish Supreme Administrative Court concluded “Morele.net saga”In its judgement from February 2023, the Supreme Administrative Court of Poland announced a significant decision from 2019 of the Polish DPA that imposed a substantial fine of PLN 2.8 million (ca. 645,000 euros) against the online retailer, Morele.net. The decision concerned Morele.net’s alleged failure to introduce adequate data security safeguards that could have enabled a phishing attack leading to the unauthorized acquisition of a customer database, violating the obligations under GDPR regarding ensuring data security and integrity.25 September 2023
• “Another breach in the wall” – the Polish DPA’s views regarding data security and notifying data breaches under the GDPRIn the ever-evolving landscape of data protection and privacy regulations, organizations must remain vigilant in upholding the security of the personal data they handle. A recent decision issued by the Polish DPA underscores this critical aspect, as the Polish DPA imposed an administrative fine exceeding PLN 47,000 (approx. € 10,000) due to implementing inadequate technical and organizational measures for safeguarding personal data and not notifying the authority about the data breach.20 September 2023
• Online identifiers are not always personal dataThe Voivodeship Administrative Court in Warsaw recognizes online identifiers, including cookies, should not be automatically categorized as personal data. Thus the Polish Court is at variance with the Polish DPA’s stricter position on that subject.11 April 2023
• The Polish DPA rules about the right to access the personal data contained in trackersThe Polish DPA (the President of the Personal Data Protection Office, further as "the Polish DPA") has reprimanded a webiste operator for infringing article 6(1), article 15 (1) and article 15 (3) GDPR. The Polish DPA also ordered the webiste operator to erase data subject’s IP adress and artificially attributed cookie id.2 May 2022
• Polish administrative court rules that the GDPR does not grant power to the data protection to order the disclosure of personal data to third parties at their requestThe Provincial Administrative Court in Warsaw ruled that Polish Data Protection Supervisory Authority is not competent to order a controller to provide a third party with access to personal data at the request of the third party. Thus it has changed the settled case law shaped under the previously applicable Act on Personal Data Protection from 1997, which was repealed by the GDPR and the new Act on Personal Data Protection from 2018.27 September 2021
• Personal data breach resulting from data subjects' mistakes have to be notified!The Polish Data Protection Authority has imposed on WARTA. S.A, a Polish insurance and reinsurance company, a new administrative sanction in the amount of c.a. EUR 20.000,00 for failure to notify a personal data breach that resulted from data subject’s mistake.4 May 2021