Clifford Chance
New legislation on personal data processing by employers
20 October 2017
On 25 May 2018 the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (the "General Data Protection Regulation", "GDPR") come into force. It provides for severe financial penalties for breaches of data protection provisions which could be as much as EUR 20 million or 4% of an enterprise's total worldwide turnover. To adjust Polish law to the requirements of the General Data Protection Regulation, the Ministry of Digitalization has prepared drafts of a number of regulations, including amendments to the Labour Code.
It seems that the intention of the Ministry of Digitalization was to ensure some liberalization of the current Polish legislation on the processing of the data of employees and candidates. For years these have been widely criticised as among the most restrictive in the world. Certain proposed amendments, however, have the opposite effect, introducing material limitations that are more restrictive than the current provisions and the requirements of the General Data Protection Regulation. These limitations are inconsistent with current market practice and do not accommodate the reasonable requirements of employers applying corporate compliance policies with regard to verification of personnel.
