Provisions of the draft Act on Foreigners require clarification

Clarifying the regulations in terms of the scope of data processing and taking into account the principle of data minimisation - these are the main reservations of Mirosław Wróblewski, the President of the Personal Data Protection Office to the proposed amendments to the Act on Foreigners.

The President of the Personal Data Protection Office included his objections to the draft amendments to the Act on Foreigners in a letter to Maciej Duszczyk, Undersecretary of State at the Ministry of Internal Affairs and Administration.

According to Mirosław Wróblewski, the President of the Personal Data Protection Office, some of the proposed amendments to the provisions - in the context of personal data processing - are not sufficiently justified and it is unclear for what purpose a particular solution is introduced. For example, the drafters do not justify the introduction of a 12-year retention period for foreigners' data in the ICT system Case Handling Module, through which applications are to be submitted, for example, for a temporary residence permit or a permanent residence permit. Also, the requirement, provided for in the draft, for foreigners to provide information about their travel document or identity document requires justification and clarification. The President of the DPA points out that different documents may have a different scope of data. Moreover, until now it was sufficient to provide only the number of such a document. It is therefore unclear what motivates the expansion of the requirements in this regard.

The President of the Personal Data Protection Office points out that the proposal to introduce the ICT system Case Handling Module requires the drafters to carry out a privacy test in the law-making process, including a data protection impact assessment resulting from Article 35(1) and (10) of the GDPR. Such a test allows for the assessment of risks and the selection of appropriate legal remedies to address the violation of the rights or freedoms of individuals. It should, therefore, be carried out by the legislator in case of creation of provisions regulating data processing, in particular with the use of new technologies, causing high risks to the rights and freedoms of data subjects due to the nature, scope, context and purposes of the processing.

Mirosław Wróblewski indicates that the introduced requirement to provide 'additional evidence that the entry and stay in the territory of the Republic of Poland is for the purpose of carrying out professional activity' is imprecise. Doubts are raised by the lack of specification of what 'additional evidence is to be presented and, consequently, what personal data derived from its content and context of use are to serve as confirmation of carrying out professional activity. The President of the Personal Data Protection Office recommends indicating examples of documents which are to constitute evidence in such cases. Additionally, it also needs to be specified how the obligation to provide evidence is to be implemented, in particular how personal data will be collected.