Draft Polish legislation to implement GDPR includes the new workplace monitoring provisions
Estimated reading time 5 minutes
The Polish Ministry of Digitization has published a draft of a new Protection of Personal Data Act and its implementing Act which introduces changes in over hundred acts of law, including the Labour Code, in order to implement the new EU-wide General Data Protection Regulation (“GDPR”).
Draft amendments to the Labour Code
Changes to be introduced to the Labour Code, consist primarily of amendments to the rules for the employers’ processing of personal data of employees and job applicants, and in particular, the requirements to obtain the appropriate authorisations to process the data of such persons.
Personal data of employees and job applicants
Limited rights to process specific data
According to the draft, the employer will be entitled to collect the following data from the employee: address, PESEL number and other personal data, as well as the personal data of the employee’s children and other immediate family members if the submission of such data is necessitated by the fact of the employee exercising the specific rights provided for in labour law.
Limited rights to process data relating to job applicants
As far as job applicants are concerned, compared to the current wording of the Labour Code, the right to request an applicant to provide his/her e-mail address or telephone number is introduced (no such right currently exists). However, it should be borne in mind that for employees, separate consent will be required to hold and process such data (even if it was obtained when they were an applicant).
The requirement for consent to processing
The employer will be entitled to process personal data other than that mentioned above only if related to the employment relationship and if the job applicant or employee agrees to that in a statement made in writing or by electronic means.
Prohibitions on processing – even with consent
According to the planned changes, the processing of personal data relating to addictions, health and sex life or sexual orientation of the employee or applicant will not be permitted even if the employee or applicant agrees to the processing of such data.
Exceptions to the rules
An exception to the above rules would be the case where the obligation to provide such data results from separate provisions, or is necessary in order to fulfill an obligation imposed on the employer by law.
Biometric and other data
Separate consent is required for the processing of the employee's biometric data if related to the employment relationship and such processing will also be subject to special technical conditions for data collection, which are to be set out in the regulation issued by the Minister of Digitization. However, biometric data cannot be processed for job applicants even with their consent. Employment protection for failure to provide consent
It should be remembered that the lack of consent to the processing of data cannot lawfully constitute grounds for less favourable treatment of the applicant or employee, nor can it entail any adverse consequences, and, in particular, it cannot provide a lawful justification for the refusal to employ, or to terminate the employment relationship with or without notice.
Monitoring - a new concept in Poland
A completely new concept in Polish labour law is the instrument of "monitoring" planned to be introduced by the draft legislation.
The draft proposes that employers will have the right to introduce special surveillance over the workplace or the area around the work establishment by video recording (monitoring).
Monitoring can only be used by employers to ensure the safety of employees or the protection of property, or safeguarding confidential information the disclosure of which could cause damage to the employer. The data collected by monitoring may only be processed for the purposes for which it was collected. At the same time, the employer will be permitted to store such data only for the time necessary to fulfill these purposes. Monitoring cannot be used as a means to manage an employee's performance. The use of monitoring in rooms that are not intended for work, in particular sanitary facilities, cloakrooms, cafeterias or smoking rooms will be prohibited.
The employer will be obliged to inform the employees of any proposed monitoring at work in advance. For new employees employers will be obliged to inform them of the monitoring before they commence work.
Draft amendments to the Act on Company Social Benefit Fund
The draft also provides for some changes to the basis of the processing of individuals’ personal data using the benefits of the Company’s Social Benefit Fund and the catalogue of data to be requested for that purpose.
What happens next?
The draft Personal Data Protection Act and its implementation have just undergone public consultation. The result of the public consultations is still to be confirmed, and therefore, the final wording and date of implementation remain open. Nevertheless, the legislation must be implemented by 25 May 2018 in order to comply with the EU GDPR obligations. It is regrettable that the Polish legislation is still not yet finalised. However, there is still much that employer can do to ensure they do all they can to prepare for the new data protection regime created by GDPR. Employers should review their internal policies and processing practices now against the provisions of the GDPR to ensure they have time to make sure they are compliant by May 2018 at the latest.
A failure to comply with the obligations imposed on the employer may trigger a fine being imposed, the amount of which is still under consultation but may, as in other EU jurisdictions, be significant.
Further information
For further information or to discuss any of the issues raised, please contact Roch Pałubicki (roch.palubicki@skslegal.pl) on +48 61 856 04 04 at Sołtysiński Kawecki & Szlęzak – www.skslegal.pl.
Resources
You may find the draft amendments to the Labour Code at:
http://legislacja.rcl.gov.pl/docs//2/12302951/12457706/12457707/dokument308373.pdf