In an email to the editorial office, the Reader wrote:

Before the holidays, I parked my car on the premises of the shopping centre on Jeleniogórska Street (near the hospital). Unfortunately, there was a problem printing the ticket. […] these parking meters leave much to be desired.

And added:

After another unsuccessful attempt, I gave up because I had to do my shopping quickly. When I returned, I found a penalty notice for not having a parking ticket on my car, under the windscreen wiper.

Of course, it is possible to file a complaint, especially since I have receipts and invoices from my purchases, proving that I was there to shop and not to use the free car park.

The reader wanted to file a complaint but gave up. Why? The complainant explains:

Because I decided that at this stage ATPark, the company responsible for the parking meters, requires too much personal data in the complaint form, such as a PESEL number! The question is: why do they need so many detailed data? Contact details, i.e. a telephone number and email address, should be enough, because everything is handled electronically anyway.

And added: – I do not trust this company because I have no certainty how my data will be used. I believe that requiring such detailed information is an abuse.

We officially asked the company mentioned above about this:

Why is providing a PESEL number required when filing a complaint?

We received the following response from ATPark’s Complaints Service Team:

Under the applicable regulations, the processing of personal data is lawful when at least one of the conditions specified in Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the GDPR) is met. According to the provision cited above, the processing of personal data is lawful only if one of the following conditions is fulfilled:
a) the data subject has given consent to the processing of their personal data for one or more specific purposes;
b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
c) processing is necessary for compliance with a legal obligation to which the controller is subject;
d) processing is necessary to protect the vital interests of the data subject or of another natural person;
e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject that require protection of personal data, especially where the data subject is a child.

The obligation to consider a complaint from a parking-space tenant arises from the applicable Regulations. The data required from tenants filing complaints are data identifying a specific person. It should be noted that a first name and surname, even when combined with an email address, are not sufficient data to identify the complainant. In accordance with the applicable complaint-submission rules, so that the data collected by the company do not constitute excessive data, the complainant has the right to choose the data identifying them. Through the online complaints system of ATPARK spółka z ograniczoną odpowiedzialnością sp.k., the complainant provides their first name and surname and PESEL number; if they choose their place of residence as the identifying data, the complainant is asked to submit the complaint in writing to the company’s registered office address. It is obvious that identifying the complainant is necessary and serves to process the complaint. It should be noted that a first name combined with a surname is a recurring piece of data; therefore, in the event of potential claims by the company against two people with identical first names and surnames, providing a PESEL number or residential address makes it possible to assign the complaint to the correct person. It should therefore be considered that processing data in the form of a first name, surname and PESEL number/residential address is intended to serve the legitimate interest of the complainant. The option for the complainant to provide their residential address as identifying data also enables people without a PESEL number to file a complaint. It should also be noted that none of the applicable provisions imposes on an entrepreneur an obligation to consider complaints electronically; therefore, the choice of the complaint procedure and, consequently, consent to provide the company with personal data—the PESEL number or residential address—belongs to the complainant.

It should be emphasised that the company represented, as the controller of personal data, takes the position that the overriding principle when collecting personal data is the principle of data minimisation; thus, ATPARK spółka z ograniczoną odpowiedzialnością sp.k. limits the number of identifiers collected and processed for a natural person. Please note that the company does not, for example, require the number and series of an identity card.

It should therefore be considered that the personal data of complainants are collected in accordance with Article 5 of the GDPR, that is, for a specific, explicit and legally justified purpose (identifying the complainant and considering the complaint), and are adequate, relevant and limited to what is necessary to achieve the purposes indicated above (data minimisation).