The Right to Public Information and State IT Security and Email Security in Public Administration: Critical Commentary on the Judgment of the Supreme Administrative Court of 19 February 2025, III OSK 878/24

Abstract

This critical commentary addresses the judgment of the Supreme Administrative Court of 19 February 2025 (III OSK 878/24), in which the Court dismissed the appellant’s cassation appeal against the judgment of the Voivodeship Administrative Court in Gdańsk of 7 December 2023 (III SAB/Gd 220/23). The court of second instance agreed with the Voivodeship Administrative Court in Gdańsk and departed from the previous case law, stating that a mere printout of a request for access to public information sent via email to the official email address of the obligated entity precludes the recognition that the addressee has received such a request. The purpose of this commentary is to indicate the evidentiary difficulties that will be borne by complainants alleging administrative inactivity in matters concerning access to public information, who submit requests in an informal manner, as well as the resulting necessity to demonstrate that the addressee has received the request. The Court’s thesis significantly limits the effectiveness of submitting requests in a non-formalized manner to entities obliged to provide access to public information. In the commented judgment, the cassation court approved a departure from the presumption – previously developed in the case law – of the delivery of a request to the official mailbox of a public authority. Against the backdrop of the practice of using email by state administration bodies and the provisions of procedural statutes, the Supreme Administrative Court’s position was analyzed, which was clearly deemed inaccurate and inconsistent with the constitutional right to obtain information on the activities of public authorities and persons performing public functions. In its justification, the Supreme Administrative Court indicated the need to balance two constitutional values: the digital security of the state, derived from the principle of the common good of all citizens, and the right to public information. The ruling, however, inappropriately attempts to assign primacy to the digital security of the state and to the security of administration bodies’ email servers, emphasizing legal regulations concerning digital security issued in the years 2020–2025. The commentary underscores the need to ensure the effectiveness of the application-based procedure for disclosing public information in a manner tailored to the capabilities and choices of the interested party.