The Commissioner for Human Rights Asks Zdanowska About Tracking on City Websites

ŁCN forwarded me a letter indicating that the City of Łódź Office received an inquiry from the Commissioner for Human Rights (Rzecznik Praw Obywatelskich - RPO). The letter dated August 12, 2026 (ref. VII.501.120.2026.AK), signed by Deputy Commissioner for Human Rights Stanisław Trociuk, is addressed to Mayor Hanna Zdanowska and contains six questions about the processing of users’ data on city websites. I publish it in full below, along with the source document.

The direct basis for the intervention is a letter from the “Łódź Cała Naprzód!” Association (ŁCN) dated July 13, 2026. The Commissioner acts under Article 13(1)(2) of the Act on the Commissioner for Human Rights, meaning he is requesting a statement and is not resolving the case. This is worth emphasizing, because the entire document is written conditionally: the described circumstances, “should they be confirmed”, could indicate a violation of Articles 47 and 51 of the Polish Constitution, Article 5(1)(a), Article 6 and Article 7 of the GDPR, and Articles 399 and 400 of the Electronic Communications Law. This is not a finding of a violation. This is a question posed to the city by a constitutional body.

The Commissioner bases the description of the facts on an “automated technical audit” published in March 2026, which allegedly showed that analytical and advertising mechanisms operated without users’ consent on 28 out of 39 examined domains. These are figures from the audit I conducted between March 6 and 9, 2026, and published in the evidence repository: 28 domains with violations, 11 clean ones. This same material formed the basis for an interpellation by city councilors on May 22 and for the response from Deputy Mayor Piotrowski on June 30, which the RPO quotes as evidence that the city does not rule out the occurrence of the described situation.

I would like to draw your special attention to three threads from the letter.

MOPS. The Commissioner explicitly points to the website of the Municipal Social Welfare Centre (MOPS) and writes about the risk “particularly significant from the perspective of protecting the dignity and privacy of people in life crisis situations”. A person seeking social support has no alternative channel.

BIP. This is the fragment that I raised in my own application to the Commissioner on July 15, and which I consider the most serious from a systemic perspective. The RPO follows the same path: the right of access to public information is granted to everyone (Article 2(1) of the Act on Access to Public Information), and the blocking mechanism can effectively exclude those who do not consent to data processing for advertising purposes from application-free access. The Commissioner also reminds about § 11(2) of the MSWiA regulation on BIP, which prohibits advertising on the entity page of the Bulletin.

PPP Agreement. Apart from the six questions, the Commissioner demands access to the public-private partnership agreement of October 28, 2020, and the Protocol of Necessity No. 1/2023 of December 19, 2023, as well as information on whether a data protection impact assessment was carried out (Article 35 GDPR). The justification is clear: these documents are of “fundamental importance for assessing the legal basis on which a private entity was to obtain the possibility of using public infrastructure and residents’ data”. These are exactly the documents to which the city referred the councilors to the operator in response to their interpellation.

Separately: the sixth question concerns whether the city reported the personal data breach to the President of the Personal Data Protection Office (UODO) pursuant to Article 33 of the GDPR. Let me remind you that my notification has been lying with UODO since November 6, 2025. Deputy Mayor Piotrowski confirmed that data was flowing to Google without expressed consent. The question is whether this was included in the GDPR register and whether it was reported to the PUODO.

My own application to the Commissioner from July 15, 2026, is still waiting for a formal response, but as you can see – the office has taken action. The involvement of the Łódź Cała Naprzód Association is great news, especially when confronted with the months-long passivity of UODO. This is exactly why watchdog organizations exist – to keep an eye on institutions and ensure that such serious topics are not swept under the rug.

Full text of the intervention

Letter from the RPO dated August 12, 2026, ref. VII.501.120.2026.AK. The original numbering of questions and the content of footnotes have been preserved. Scan of the original attached.

Commissioner for Human Rights

Warsaw, 12-08-2026

VII.501.120.2026.AK

Ms. Hanna Zdanowska Mayor of the City of Łódź City of Łódź Office e-mail: lckm@uml.lodz.pl

Dear Madam Mayor,

A letter from the “Łódź Cała Naprzód!” Association (hereinafter: the Association) has been received by the Office of the Commissioner for Human Rights, which I kindly enclose herewith. From the indicated letter, as well as from the correspondence attached to it – including the interpellation of the councilors of the Łódź City Council of May 22, 2026, and the response to it of June 30, 2026¹ – it can be concluded that in March 2026, the results of an automated technical audit were made public, which allegedly showed that on 28 out of 39 examined Internet domains related to the Łódź digital ecosystem – including the lodz.pl portal, the websites of the City of Łódź Office, the Public Information Bulletin, the Municipal Social Welfare Centre (hereinafter: MOPS), and Orientarium Łódź – analytical and advertising mechanisms were implemented without the required consent of users, which involved the transfer of data to external private entities. In the response of the Deputy Mayor of Łódź to the mentioned interpellation of the councilors, the occurrence of the described situation was not ruled out, pointing out at the same time that the internal analysis did not allow unequivocally determining how the infrastructure of external entities processed the received user data.

Of particular importance to the case is the suspicion that analytical and advertising mechanisms could have also functioned on the MOPS website, i.e., on a website used by people in difficult life situations, seeking social support. If the findings regarding the possible operation of tracking mechanisms on this domain were confirmed in practice, one could speak of a risk particularly significant from the perspective of protecting the dignity and privacy of people in life crisis situations.

The circumstances described above, should they be confirmed, could indicate a violation of Article 47 and Article 51 of the Polish Constitution – the right to privacy and the right to personal data protection and control over data concerning oneself; Article 5(1)(a) and Article 6 of the GDPR – principles of lawfulness, fairness, and transparency of personal data processing, as well as Article 7 of the GDPR – requirements regarding the validity and voluntariness of consent, and the Act of July 12, 2024 – Electronic Communications Law (Journal of Laws of 2024, item 1221, of 2025, items 637, 820, of 2026, items 252, 815, hereinafter: PKE), regarding the rules for installing cookies and using users’ terminal equipment².

Similar doubts are raised by the circumstance that the same analytical and advertising mechanisms seem to function on the entity page of the Public Information Bulletin. It should be noted that under Article 2(1) of the Act of September 6, 2001, on Access to Public Information³, the right of access to public information is the right of every person. Meanwhile, the blocking mechanism may effectively exclude those who do not consent to the processing of their personal data by the city authorities for advertising purposes from application-free access to public information posted in the BIP.

Also importantly, § 11(2) of the Regulation of the Minister of the Interior and Administration of January 18, 2007, on the Public Information Bulletin⁴ excludes the possibility of placing advertisements on the entity page of the BIP. Although this provision does not refer directly to analytical and advertising mechanisms, it is difficult to accept that their implementation on the entity page of the BIP is compliant with the assumptions according to which the BIP is to be a portal maintained from public funds serving the effective dissemination of public information in a generally accessible manner – and not the commercial acquisition of personal data for advertising purposes.

In the letter to the Commissioner, the Association also pointed to possible organizational ties between the City of Łódź Office, the Łódź Tourist Organization Association (operator of the Łódź Citizen Card system and the Łódź.pl application, used by over 350,000 residents), and the Łódź Media Group company operating within it, which publicly declares possessing large databases used for marketing and advertising purposes.

Due to the subjective scale of the case – concerning, as the Association points out, approximately 700,000 residents of Łódź using city websites and over 350,000 participants in the Łódź Citizen Card program – and also due to the involvement of public funds and entities related to the City of Łódź Office in the described mechanism, acting pursuant to Article 13(1)(2) of the Act on the Commissioner for Human Rights (Journal of Laws of 2024, item 1264, as amended; hereinafter: the Act on the Commissioner), I turn to you, Madam Mayor, with a request to take a position on the matter and provide answers to the following questions:

1. Were the public suspicions of irregularities regarding the use of analytical and advertising mechanisms confirmed as a result of an internal audit conducted by the City of Łódź Office? In the event that the indicated analysis was carried out, I kindly ask you to provide a copy of it to the Commissioner or to present the findings made.

2. Has it been analyzed to what extent the personal data of users of official websites, including the MOPS website in Łódź, could have been transferred to third parties before consent was given?

3. Has an analysis been conducted of the possibility of actual limitation of application-free access to public information to the circle of users of the BIP entity page who express consent to the processing of personal data, which could have been caused by the implementation of the blocking mechanism?

4. What entities act as controllers or joint controllers of personal data processed under the Łódź Citizen Card system and the Łódź.pl application, and were appropriate arrangements made within the meaning of Article 26 of the GDPR between the City of Łódź Office and the Łódź Tourist Organization Association and Łódź Media Group?

5. Are the personal data of residents collected under the Łódź Citizen Card program used for marketing or advertising purposes by commercial entities related to the system operator, and if so – on what legal basis and to what extent are residents informed about this?

6. In connection with the described case, was a notification submitted to the President of the Personal Data Protection Office about a possible personal data breach within the meaning of Article 33 of the GDPR?

At the same time, I request that the Commissioner be provided with the content of the Public-Private Partnership Agreement of October 28, 2020, and the Protocol of Necessity No. 1/2023 of December 19, 2023. These documents are of fundamental importance for assessing the legal basis on which a private entity was to obtain the possibility of using public infrastructure and residents’ data. I also ask for information on whether a data protection impact assessment, referred to in Article 35 of the GDPR, was carried out during their conclusion and subsequent expansion of the system.

Appropriate explanations and information in response to this address will be helpful for the Commissioner’s comprehensive analysis of the case. I kindly ask for their timely provision, along with making available the relevant documents cited in the letter.

Yours faithfully,

Stanisław Trociuk Deputy Commissioner for Human Rights

/-issued and signed electronically/

Attachment: – letter from the “Łódź Cała Naprzód!” Association of July 13, 2026.

For the information of: – Applicant – “Łódź Cała Naprzód!” Association

Attachments

• Intervention of the Commissioner for Human Rights of August 12, 2026, ref. VII.501.120.2026.AK (PDF)

Context of the case

• Notification to UODO and UKE: update on lodz.pl and city websites of UMŁ
• The city admits to irregularities but blames Google and the operator (ŁOT), which it funds itself
• Application to the Commissioner for Human Rights regarding mass processing of Łódź residents’ data
• Evidence repository: audit of 39 city domains