Poland: Effects of the GDPR on the employer's obligations

Background
The EU GDPR came into force on 25/05/2018. The Polish draft law implementing the Regulation leads, among other things, to changes in the area of labour law. In future, employers will be subject to new transparency and information obligations, for example with regard to application and recruitment procedures and the scope of the employee data collected.

Recruitment policy
According to the new regulations, the employer will only be entitled to require the applicant to disclose his name, date of birth, contact details, education and previous employment relationships. Only the collection of these contact data will no longer require the applicant's consent. However, the employer will no longer be allowed to collect the names of the parents.

Employee data
According to the new legal regulations, the employer can request further data from an employee already hired, such as the residential address, the so-called PESEL number (Polish personal identification number), the identity card data, information on another proof of identity and other data, if this is justified by the employee's activity in accordance with employment law requirements. In particular, the employer can then also collect and process information on the employee's children and family members. In addition, the employer remains entitled to collect further data if the corresponding authority can be derived from other legal acts.

Biometric data (eg fingerprints) can only be used for the purpose of access control if particularly important information of the employer must be protected thereby against unauthorised disclosure or premises against unauthorised access.

Control of employees
On 25th May 2018 also the new Polish Data Protection Act came into force. The Act supplements the regulations of the GDPR and modifies the provisions of the Polish Labour Code regarding possibilities of employees’ control at the workplace. For the first time, video surveillance is regulated by law. Video surveillance will may only be permitted for employee security, property protection, production control or confidentiality of information. Rooms such as canteens, changing rooms or sanitary facilities have to be completely excluded from video surveillance. In exceptional cases, however, cameras can also be installed in such areas. The employer must inform the employees of the type and extent of video surveillance in an appropriate manner (eg in the work regulations and by posting).

Under the new rules, however, the employer still has the power to check employees' emails to ensure that employees do not waste their working time and use equipment properly. The amended provisions also leave it open as to the possibility of introducing other forms of employee control in compliance with certain data protection regulations, among others.

Authors: Aleksandra Baranowska-Górecka & Anna Materla