Under Article 88 of the EU General Data Protection Regulation, member states may provide specific rules in respect of processing of employees’ personal data in the employment context. Poland has recently proposed new law provisions that specify the rules of employee data processing. This proposal is still under public consultation, but it is worth presenting some of the major solutions proposed by the Polish legislature.

General rules

Under the new laws, a prospective employer will be entitled to process the following data of a candidate employee: name, surname, date of birth, correspondence address, email address or telephone number (not both), education, and professional experience.

An employer will be entitled to demand from an employee the following personal data: residual address, personal identity number (if none, than number of an ID document), other personal data if their processing is necessary to enable the employee to use social benefits. The employer shall process such personal data only within the scope necessary for the employment relationship.

The employer will be entitled to continue to process the personal data provided by employee candidates for the duration of their employment. Exceptions to this include information on correspondence address, e-mail address and telephone number. Such personal data may be only processed upon the employee’s consent.

Employee consent would be also required for processing biometric data, and consent for processing of biometric data may only be taken from an employee, not from an employee candidate. The draft states that lack of consent should not lead to the discrimination of an employee candidate or an employee, including not offering a candidate a job or dissolving an employment contract. There is a bit of inconsistency here, as the consent for processing of biometric data may only be taken from a current employee, so there should not be a situation in which the candidate employee is discriminated due to a refusal of the consent.

It is worth underlining that the concept of voluntary consent by an employee has been questioned a couple of times in Polish court verdicts. As a result, Polish employers have been avoiding this legal basis for processing personal data of their employees. The newly proposed laws change completely the way the concept of employee consent should be seen.

The employer will be forbidden to process the following special categories of employee personal data even upon the employee’s consent: information on addictions, health and sex life or sexual orientation. This provision may be impossible to realize, as employees may wish to provide such personal data to the employer. For example, an employee may wish to officially report an ethical issue related to sexual orientation to the employer with the use of an ethical hotline set up by the employer.

Employers will be entitled to process personal data other than mentioned above only if it is necessary for compliance with a legal obligation to which the employer is subject. Except for that, the employer will be entitled also to use visual monitoring of employees only if this is necessary to provide security to the employees or protect the employer’s property or trade secrets.

Specific rules for financial sector

The draft law has special rules for processing employees’ personal data for employers that belong to the financial sector (namely, banks, payment institutions and electronic money institutions).

Such employers will be entitled to process information about convictions and offences of the candidate employees and employees. This entitlement in the proposed wording is broad enough to enable financial services employers to demand such sensitive information from nearly all its employees. Moreover, the same right applies to data processors of such financial institutions (being employers themselves) that have been commissioned with rendering specific banking or payment services.

Banks, payment institutions and electronic money institutions will also be entitled to demand from their employees that they provide their biometric data such as fingerprints, vein pattern, voice pattern or iris pattern if this is necessary for the purposes of access control to information processed by the employer and its premises. Again, this entitlement in the proposed new law is very broad and may affect nearly all employees of such an institution.

These special categories of employers will be entitled to process such sensitive personal data only during the term of the employment.

Summary

On one hand, the proposed employee data processing regulation responds to many requests of employers to broaden and update the scope of personal data that can be processed by them. On the other hand, however, it provides privileges only to a narrow group of employers (banks, payment institutions and electronic money institutions), enabling them to carry out some background screening and using biometric technologies in relation to nearly all their employees.

Looking at past experiences with processing employees’ personal data by corporate groups located in different EU countries, if the proposed new regulation is to be adopted as binding law, it will not allow such corporate groups to process personal data about their employees in the same scope in Poland as they are processed in the other countries.

Photo credit: Olek Remesz (wiki-pl: Orem, commons: Orem) - Own work, CC BY-SA 3.0, Link