The Supreme Administrative Court held that private devices do not relieve controllers
The judgment of the Supreme Administrative Court (NSA) of 8 September 2026, the full text of which is available in our Judykatura database, draws a practical boundary around controller responsibility in remote working and the use of private devices. The Court confirmed that a controller cannot transfer to an employee responsibility for designing, implementing and demonstrating adequate safeguards.
The rest of this analysis, all theses and the full text of the ruling are available with an AKTUALNOŚCI PLUS subscription.
Find out how EU supervisory authorities, administrative and civil courts and the CJEU reason their decisions — and keep your organisation aligned with current case law.