Poland adjusted over 150 Polish sectoral acts to GDPR

Amendments to the Labour Code

Pursuant to the amendment of the Labour Code, employers are now entitled to ask a job applicant, in particular, about his/her contact details. However, the applicant may decide what details he/she will provide. The residential address may be requested only from an employee. Data of applicants/employees can also be processed based on their consent. Failure to provide consent to data processing or the revocation of given consent can not be used as a basis for any adverse treatment and can not cause any negative consequences for the individual, in particular, it can not constitute the reason for the refusal of employment or termination of the employment relationship. Also, the processing of special categories of personal data stipulated in Art. 9.1 GDPR is permissible, however, only if the provision of data occurs at the initiative of the applicant/employee. Therefore, the employer can not ask the applicant/employee for such data.

Amendments to the Banking Law

The Act introduces a statutory right for banks to use automated processing of personal data, including profiling, for the purposes of determining the creditworthiness of a data subject and carrying out a credit risk analysis, without the consent of the data subject (the application for credit constitutes the basis of such processing) to the Banking Law. However, such decisions can not be made based on special categories of personal data (such as: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, data concerning health or data concerning a natural person’s sex life or sexual orientation). Additionally, the Act reserves the right of the client to: (i) receive an explanation of the basis of the creditworthiness assessment made by a bank;  (ii) obtain human intervention in order to make a re-decision and (iii) express its own position. It is necessary to emphasize that only a client which is consumer will receive an explanation without any additional costs.

The Act will enter into force 14 days after being published, subject to certain exceptions (i.e., 90 days after being published for certain amendments in the act on passport documents; on 1 May 2019 for certain amendments in the act on population records; on 13 October 2019 for certain amendments in the act on counteracting money laundering and terrorist financing).