On April 25, 2024, the Polish data protection authority (UODO) announced that its President had sent a letter to the Minister for European Union Affairs presenting observations on the Court of Justice of the European Union (CJEU) case C-604/22 IAB Europe of March 7, 2024. In particular, the UODO mentioned that the case confirms its practice and approach to the definition of personal data contained in Article 4(1) of the General Data Protection Regulation (GDPR).

The UODO recounted that the ruling states that a string consisting of a combination of letters and characters containing information about the preferences of an internet or app user relating to that user's consent to the processing of personal data, including by website providers, constitutes personal data when such a person can be identified in combination with additional data. This may include the IP address of the user's device or other identifiers. Therefore, the UODO assured that there was no need to change national regulation in light of this ruling, as it affirms the UODO's pre-existing belief that the concept of personal data should be understood broadly.

Furthermore, the UODO emphasized that the ruling also corresponds with its adopted assessment of the protection of personal data in the cases it handles in the context of the concepts of controller and co-controller.

You can read the press release here and the letter here, both only available in Polish.