Poland: GDPR: Changes in Employment Law

On the 4th of May 2019 amendments to a number of acts (including the Labour Code) entered into force in order to adapt the Polish legal system to the GDPR. In consequence, employers should take specific actions to adapt their activities to the new legal requirements.
In connection with the entry into force of GDPR, on 25 May 2018 each Member State was obliged to ensure its effective application in its legal system by adopting appropriate internal regulations. For this purpose, in addition to the adoption of the new Act on Protection of Personal Data, it has also become necessary to make numerous modifications to other national acts.

In consequence of the introduced changes in legal acts Employers should undertake actions in particular in the following areas:

1. Verifying the content of questionnaires

Employers should verify the content of questionnaires used in the recruitment process and shall adapt them so that they include the new catalogue of information that may be requested from candidates.
As an example data regarding solely education, professional qualifications and the course of previous employment can be requested, when it is necessary to perform specific types of work or a given position.

2. Verifying the legality of the basis to process personal data of applicants and employees

Employers will not be entitled to process personal data concerning convictions and offenses, even with the consent of the data subject. Their processing will only be possible if it results directly from regulations of law (e.g. in relation to selected employees of financial sector entities).

Applicants and employees will be able to provide employers with personal so-called special category data that is: personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data, for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation only on their own initiative and agree to their processing.

3. Obtaining written consents to process personal data

Employers will have to obtain written consents to process the so-called special category data (specified in point 2 above) and personal data related to health.

4. Verifying video monitoring system

The use of video monitoring in the premises made available to the Employer’s trade union organization and in sanitary rooms is no longer permissible. Such monitoring system should be removed. If the employer uses video monitoring of sanitary rooms it must obtain consent for its use from trade unions or representatives of employees. In the event of failure to obtain the consent or if such consent is refused, the employer is obliged to cease the use of video monitoring.

5. Introducing effective verification procedures

Employers are obliged to review - at least once a year - personal data collected in order to determine the necessity of their further storage and, if necessary, remove them.

We would be pleased to provide you with more ample information and advice in relation to the above.