Today, I submitted a request to the Commissioner for Human Rights (Ombudsman) regarding the mass processing of Łódź residents’ data without consent. Despite the fact that the Deputy Mayor of Łódź officially admitted to irregularities in municipal websites in June, and the case is being investigated by the prosecutor’s office, supervisory authorities (UODO, UKE) have not taken any visible actions towards the residents for many months. In the open letter, I point out, among other things, the discrepancy between the statements of UODO and the City of Łódź, as well as the real risk of losing evidence due to the announced removal of ‘old and inadequate codes’.

Łódź, July 15, 2026

Office of the Commissioner for Human Rights

al. Solidarności 77

00-090 Warsaw

Applicant: Maciej Lesiak, resident of Łódź, editor of the dadalo.pl press title (Publisher Signal Dadalo Media), Łódź

Request to the Commissioner for Human Rights to take up the case

Subject: request to take up the case under Article 80 of the Constitution of the Republic of Poland and the Act of July 15, 1987 on the Commissioner for Human Rights - concerns the processing of personal data of 1 million visitors (including over 350,000 participants of the Łódź Resident Card program) on the websites of the City of Łódź (including the Public Information Bulletin), the passivity of supervisory authorities despite the City itself confirming the irregularities, the conditions of access to the Public Information Bulletin, and the risk of losing evidence.

Introduction

My journalistic investigation concerning the processing of residents’ data on the websites of the City of Łódź has been confirmed by the controlled institution itself. In a letter dated June 30, 2026, which was a response to an interpellation by the city councilors of Łódź, the Deputy Mayor of Łódź officially admitted for the first time that the irregularities I described could have taken place, announced corrective actions (“it has been ordered to remove any old and inadequate codes”) and the conduct of an internal audit.

I am appealing to the Commissioner because despite this admission - and despite the fact that the same case is currently being investigated by the prosecutor’s office, and the findings have been confirmed by whistleblowers providing source documents - the authorities established to protect personal data (President of the Personal Data Protection Office - UODO) and electronic communications (President of the Office of Electronic Communications - UKE) have not taken any visible actions towards the residents for many months. The only mechanism that forced any correction turned out to be the councilors’ interpellation - not state supervision.

I. Factual background (chronologically)

May 2025: I published an article describing the lodz.pl portal as a commercial advertising infrastructure operating under the guise of a public service (dadalo.pl).
November 6, 2025: I submitted to the President of UODO an extensive (approx. 40 pages) notification of suspected systemic violations of the GDPR in the lodz.pl portal ecosystem, containing 9 charges - including processing of sensitive data (Art. 9 GDPR), hidden joint controllership (Art. 26 GDPR), the use of illusory consent banners, and commercial monetization on the pages of Public Information Bulletins. The notification (ref. DWKSN.523.9422.2025) included a request to secure evidence; I supplemented it with letters dated February 25 and March 10, 2026 (in March I created the dowody.dadalo.pl website with the result of a technical audit of 41 municipal domains). [Attachment 4]
January 2026: In a telephone conversation with UODO, I was informed that the case had been assigned to a substantive employee (legal counsel conducting the case).
February 2026: The Chairman of the City Council in Łódź sent a letter to the councilors calling for special caution regarding the GDPR and data processing, including stopping the leaking of sensitive data. During the same period, “Gazeta Wyborcza” contacted me regarding the thread of rigged advertising tenders of the Łódź Tourist Organization (ŁOT) in the context of my first article from May 2025. I kept the notification secret practically until that moment, considering it to be in the interest of the case; it was then that I passed the information about the case to the editorial office for the first time.
March 6, 2026: “Gazeta Wyborcza” published a material (“Hundreds of thousands of Łódź residents tracked on a massive scale. Advertising schemes of ŁOT”), in which the UODO spokesperson publicly confirmed that the case had been received by the office and is being analyzed - thus the authority was conducting proceedings in it. GW described, confirming with UODO, that the case is being processed and confronting the theses of the allegations with representatives of the Łódź City Hall (UMŁ). Representatives of UMŁ and ŁOT stated that there are no technical or legal problems and everything is legal. [Attachment 7]
March 13, 2026: I submitted a notification to the President of UKE regarding suspected violation of Article 399 of the Electronic Communications Law Act (saving information on end devices without consent) on 29 out of 41 tested municipal domains, with a request to secure technical data. In my opinion, the scale of the phenomenon and the functioning of these tracking mechanisms on the Public Information Bulletin (BIP) qualified it for proceedings by UKE in a technical context. [Attachment 5]
March 27, 2026: UKE (letter DB.WPZN.622.18.2026.2) informed that control is initiated exclusively ex officio (Art. 423 PKE), citizens’ submissions do not bind the authority, securing evidence is possible only as part of formally initiated proceedings, and the applicant will not be informed about a potential initiation of control. [Attachment 3]
March 30, 2026: Independently, I submitted to the Independent Department for Cybercrime and Informatization of the Regional Prosecutor’s Office in Poznań a notification of reasonable suspicion of committing crimes (Art. 287 § 1 Penal Code, Art. 286 § 1 Penal Code, Art. 107 of the Personal Data Protection Act, alternatively Art. 231 § 1 Penal Code) in connection with the possible transmission of signals to the Google advertising infrastructure. The case was transferred according to jurisdiction to Łódź, and then to Ostrów Wielkopolski. I am currently in the process of updating these threads with new facts provided by whistleblowers. [Attachment 8]
April 20, 2026: Due to the lack of information about the authority’s activities, I sent a reminder to the President of UODO within the meaning of Art. 37 of the Code of Administrative Procedure (KPA), pointing out, among other things, the exceeding of the deadline from Art. 78 sec. 2 GDPR and informational asymmetry (the authority provided information to the media, but not to the complainant). [Attachment 6]
April 23, 2026: The Director of the Control and Violations Department of UODO replied that: (a) no ex officio administrative proceedings had been initiated in the case, therefore the KPA provisions, including Art. 37, do not apply; (b) my correspondence does not constitute a complaint because it concerns systemic violations, not the processing of my data; (c) taking action is an autonomous decision of the authority; (d) in the event of action being taken, I will not be a party to the proceedings and will not be informed about its course or result. [Attachment 2]
May 22, 2026: Three councilors of the City Council in Łódź (S. Bulak, M. Buchali, P. Cieplucha) submitted an interpellation based on the material of my audit, containing detailed technical questions (GA4 identifiers, GTM containers, Consent Mode parameter, joint controllership, profiling in the Łódź Resident Card).
During the course of the case, my findings began to be independently confirmed by insiders and whistleblowers, providing source documents and internal information concerning the investigated entities. I am in contact not only with councilors from various political options concerned about the scale of the irregularities, but also with NGOs dealing with urban issues and data processing. Given the passivity of the PUODO authority in the scope I also signaled in other notifications (the Łódź Orientarium case), I am establishing contact with international organizations because tourists’ data is also being processed (Tourist Card and municipal WWW services).
June 30, 2026: The Deputy Mayor of Łódź, in response to the interpellation: (a) officially admitted for the first time that the technical condition documented in the audit (data transmission with the consent status “not set”) could have taken place; (b) announced the conduct of an internal audit; (c) informed that “it has been ordered to remove any old and inadequate codes”; (d) simultaneously stated that the city “has not recorded complaints or notifications regarding privacy and security,” and the internal analysis was initiated only by the interpellation. However, it is worth noting the scope of the councilors’ questions and the evasive answers of the Deputy Mayor, who refers to other entities claiming not to be a party, while these entities were established by UMŁ, or are supervised by UMŁ through contracts. This shows the problem of informational asymmetry and mechanisms of simulating social participation. [Attachment 1]

II. Passivity of authorities despite confirmation of irregularities

The situation on the day of drawing up this request is as follows. The controlled institution - the City of Łódź - itself admitted that irregularities could have occurred and announced their removal. The prosecutor’s office is conducting proceedings regarding crimes. Whistleblowers have provided documents confirming the findings. Despite this, neither of the two supervisory authorities specialized in data protection (UODO) and electronic communications (UKE) has taken any visible actions towards the residents, and UODO - as is clear from the letter of April 23, 2026 - maintains that the notifying person has no right to information about the course of the case.

Separately, I point out a discrepancy which, as a notifying person, I am unable to resolve: from the public statement of the UODO spokesperson (point 5) it follows that proceedings in the case were pending; from the statement of the Deputy Mayor of June 30, 2026 (point 13) it follows that until that day the City had not recorded any complaints or notifications in this matter. This means that either the authority’s activities for nearly eight months from the submission of the notification did not cover the controlled entity in a manner perceptible to it, or the statement submitted to the councilors diverges from the factual state. Each of these possibilities requires clarification.

III. Systemic problem

From the UODO letter of April 23, 2026 (point 10), the following legal structure emerges: a citizen who documents a violation concerning exclusively their own data has a complaint under Art. 77 GDPR, opening administrative proceedings with the rigors of KPA. A citizen who documents a systemic violation - concerning hundreds of thousands of people - has only a notification at their disposal, which is not subject to any deadlines, is not subject to KPA provisions, does not grant party status, does not give rise to a right to information about actions taken or the result, and the decision to take action is entirely discretionary. An identical structure applies under Art. 423 PKE (point 7).

The result: the effectiveness of protection resulting from Art. 47 and 51 of the Constitution of the Republic of Poland and Art. 8 of the Charter of Fundamental Rights of the EU is inversely proportional to the scale of the violation. The more people the violation concerns, the weaker the position of the notifying person. In this case, the only activity after which an observable correction in municipal services occurred (points 11 and 13) was the councilors’ interpellation.

I emphasize that even if the authority denies my letters the status of a complaint initiating administrative proceedings under Art. 77 GDPR, they remain at least a petition within the meaning of Art. 63 of the Constitution of the Republic of Poland and Section VIII (Art. 221 et seq.) of the Code of Administrative Procedure. According to the established jurisprudence of administrative courts, citizens’ letters that do not meet the requirements to initiate jurisdictional proceedings should be processed under the complaint and petition procedure, which imposes on the authority the obligation to resolve the matter without undue delay (Art. 237 § 1 KPA) and to notify the submitter about the manner of its resolution. From the correspondence I possess, it does not appear that the authority applied even this minimal regime. This means that UODO evades not only the procedural rigors of the GDPR, but also the fundamental guarantees arising from the constitutional right to petition.

IV. Access to public information conditional on tracking (Art. 61 of the Constitution of the Republic of Poland)

I consider this thread to be the most constitutionally serious and ask for the Commissioner’s special attention.

The Public Information Bulletin of UMŁ (bip.uml.lodz.pl and BIP of other units indicated in the audit) is an official teleinformatic publisher within the meaning of the Act of September 6, 2001 on access to public information and the MSWiA ordinance of January 18, 2007. Its systemic function is to implement the citizen’s right to information about the activities of public authorities (Art. 61 of the Constitution of the Republic of Poland), and therefore a tool of citizen control over the authorities. The citizen does not have an alternative, equivalent channel of access to the information published there.

The audit showed (Attachment 6) that precisely on this domain - serving the control of authorities - Google’s analytical and advertising tools were launched and sent data before the user took any action. The mechanism of alleged consent was based on a programming library unsupported for over a decade, which did not block these tools. In the letter of June 30, 2026, the City described this solution as a “proprietary tool created for the needs of UMŁ,” which is in direct contradiction with the content of the source code served from municipal servers, possible for independent verification.

The result is systemically unacceptable: a citizen who wanted to exercise the constitutional right to information about authorities was at the same moment - without their knowledge and consent - subjected to commercial tracking for third parties. A tool serving citizen control over authorities has been transformed into a tool for observing the citizen. Access to public information cannot be de facto conditioned on submitting to tracking - and such a condition, although unwritten anywhere, was technically created.

This thread violates not only Art. 61 of the Constitution of the Republic of Poland. According to Art. 51 sec. 2 of the Constitution of the Republic of Poland, “public authorities may not acquire, collect and make available other information about citizens than is necessary in a democratic state ruled by law.” Running tools on an official teleinformatic publisher that acquire telemetry data of citizens and make them available to commercial entities for advertising purposes obviously exceeds the scope of information necessary to carry out public tasks - and thus constitutes a direct violation of the constitutional norm defining the limits of state interference in citizens’ privacy.

V. Risk of losing evidence

I have been requesting both authorities to secure the configuration of systems, the history of Google Tag Manager container versions, Consent Mode settings, and logs since February 2026 (points 2 and 6). UKE replied that it will not secure them without initiated proceedings (point 7); from none of the documents I have does it appear that any authority has secured them. At the same time, the City announced the “removal of any old and inadequate codes” (point 13). The material allowing the establishment of the full scope and history of violations - important not only for the UODO proceedings, but also for the ongoing prosecutorial proceedings - may therefore be currently overwritten. The dadalo.pl editorial office maintains its own evidentiary repositories, but they do not replace official securing.

VI. Conclusions

I request:

an appeal to the President of UODO - under Art. 13 sec. 1 point 2 of the Act on the Commissioner for Human Rights - for an explanation of what actions have been taken in the case since November 6, 2025, whether they covered the entities indicated in the notification, and whether and when the evidence was secured as I requested, and whether they appealed to the entities I indicated to introduce changes in order to ensure data protection - as well as to take immediate action aimed at securing this material against its overwriting in connection with the cleaning works announced by the City. This also refers to e-mail correspondence, protocols, teleinformatic data from the document circulation system, etc.;
an appeal to the Mayor of the City of Łódź - under Art. 13 sec. 1 point 2 of the Act on the Commissioner for Human Rights - for an explanation of the basis for the statement of June 30, 2026, that “no complaints or notifications were recorded,” in the context of the publicly confirmed UODO proceedings, and for an explanation of the compliance of the conditions of access to the municipal BIP with Art. 61 and Art. 51 sec. 2 of the Constitution of the Republic of Poland (point IV);
considering a general appeal - under Art. 16 sec. 2 point 1 of the Act on the Commissioner for Human Rights - concerning the problem described in point III: the lack of any procedure - with deadlines, subject to control, guaranteeing a minimum of feedback - for a citizen notifying supervisory authorities about mass data protection violations;
drawing the attention of the competent authorities (including the Prosecutor’s Office) to the urgent need to secure the evidence described in point V, before it is overwritten in connection with the City’s announced cleaning works.

VII. Supplementary information

In parallel, I am exhausting the individual remedies available to me: a complaint under Art. 77 GDPR in my own case and requests for access to data under Art. 15 GDPR. This request concerns exclusively issues that individual remedies by definition do not cover. The request has the character of an open letter and is published on dadalo.pl; I remain at your disposal with full technical and legal documentation.

Respectfully,

Maciej Lesiak

Attachments:

Letter from the Deputy Mayor of the City of Łódź of June 30, 2026 (response to the councilors’ interpellation) DSiP-BPM-IV.0003.1.2026DSiP-BPM-IV .0003.1.2026
Letter from UODO of April 23, 2026 (Director of the Control and Violations Department) DKN.5101.148.2026
Letter from UKE of March 27, 2026 (DB.WPZN.622.18.2026.2)
Notification to UODO of November 6, 2025 (DWKSN.523.9422.2025) along with supplements of 25.02 and 10.03.2026.
Notification to UKE of March 13, 2026.
Reminder to UODO of April 20, 2026.
Technical audit documentation and a list of press publications (“Gazeta Wyborcza”, March 2026) - https://dowody.dadalo.pl/lodz-rodo-2025/
I will release the full documentation upon the authority’s request: Notification to the Regional Prosecutor’s Office in Poznań of March 30, 2026 (with a request for supervision by the National Prosecutor’s Office) then transferred to the District Prosecutor Ref. Act: 2006-1.Ko.21.2026 Regional Prosecutor’s Office in Łódź 1st Department for Economic Crime, and later forwarded to Ostrów Wielkopolski.