Comments of the President of the Polish SA on the Presidential draft law on personal assistance

The draft law on personal assistance requires the ordering of the rules for the processing of personal data. The President of the Personal Data Protection Office has provided the Speaker of the Sejm (lower chamber of the polish Parliament) with comments on the draft.

The proposed law is intended to create rules for the granting and implementation of personal assistance services for persons with disabilities based on individual determinations of the support needed for independent life.

Comments by the President of the Personal Data Protection Office

The provision of personal assistance services will require the processing of personal data of persons with disabilities and their families, as well as of the assistants themselves. This is not only so-called ordinary data, but also special category data. Therefore, it is important to ensure compliance of the data processes acquired for the implementation of the personal assistance service with the GDPR.

A properly conducted data protection impact assessment is therefore necessary, which should lead, inter alia, to the demonstration of the necessity of the processing of personal data indicated in the proposed legislation in a specific manner, for a specifically indicated purpose and scope. The impact of these data on the privacy of the persons covered by the assistance service also needs to be assessed. In addition, the purpose of the processing must be specified in the legal basis when it is the provisions of generally applicable law (Article 6(3) GDPR).

In the opinion of the President of the Personal Data Protection Office, carrying out a data protection impact assessment would also allow for the correct shaping of roles in data processing processes and scopes of responsibility of entities performing tasks at particular stages of the assistance service implementation, as well as relations between these entities.

For other comments on the draft Act and an in-depth analysis of the concerns, please see the Opinion of the President of the Personal Data Protection Office, which is attached  below.