President of the Polish SA comments on the draft act on supporting parents
Mirosław Wróblewski, President of the Personal Data Protection Office, commented on the draft act on supporting parents in their professional activity and in the upbringing of a young child - 'Active Parent'.
The necessity to ensure transparency in the processing of personal data, the overly broad or even inadequate scope of the collected data necessary to fulfil the assumed purposes - these are the main concerns of the President of the Personal Data Protection Office to the regulation proposed by the government, which is already at the final stage of legislative work.
Mirosław Wróblewski, the President of the Personal Data Protection Office, in his comments to the draft act submitted to the Sejm of the Republic of Poland (lower chamber of the Polish Parliament), indicated that due to the nature of large-scale processing of personal data, including special categories of data, provided for in the draft regulations, it is necessary to conduct a privacy test, which is required by the GDPR in certain cases. It is also necessary to conduct a data protection impact assessment of these regulations. This will help to properly structure regulations that deal with the processing of personal data.
The President of the Personal Data Protection Office also noted that the draft act does not indicate where, for example, information on the deprivation of parental rights is to come from, which is to be the basis for not granting the new 'Active Parent' benefit. Supplementing the provisions in this regard is necessary to ensure transparency in the processing of personal data.
The draft does not specify the rules of data exchange for the purposes of implementing the benefits provided for in the draft. The President of the Personal Data Protection Office explains that the draft only mentions that the Voivode, using the System of Electronic Exchange of Information, 'exchanges data' within the scope of the benefit 'active parents at work' and 'active at home'. And this leads to the creation of the possibility to freely shape the manner and scope of the processed data, especially as the designer does not indicate the purpose and scope of the data exchange.
Among the personal data listed in the application for establishing the right to the "active parents at work" benefit include, among others, the date of birth of the applicant (mother or father). In the opinion of the President of the Personal Data Protection Office, the proposed solution is redundant and unjustified, because in accordance with the project, the national identification number (PESEL) is processed, which clearly identifies a specific natural person and indicates their date of birth. Only the age of the child is relevant for the implementation of the proposed benefit, and the age of the parents is irrelevant.
The provision according to which a final court decision pronouncing a divorce or separation is to be attached to the application for establishing the right to the 'active parents at work' benefit also requires reflection. As a consequence, this will lead to the acquisition of personal data in a broader scope than necessary to establish the right to the benefit , which may lead to the processing of personal data contrary to the principles arising from GDPR.
"It should be noted that the court in the divorce judgment decides on the entirety of the issues related to the functioning of the family ( marital, parental, maintenance, housing, property indicated in the legislation). Therefore, attaching the full content of the aforementioned document will constitute the processing of a number of circumstances and personal data which are not necessary for the purpose of determining the right to the 'active parents at work' benefit," - we read in Mirosław Wróblewski's comments sent to the Sejm of the Republic of Poland. In addition, such judgments may include, for example, third party data, both ordinary and special category data.
There are also doubts about the lack of indication in which specific IT system the applications are to be processed and the right to the benefits provided for in the project to be established - it is not known, for example, whether it will be a new system.
The President of the Personal Data Protection Office also has concerns about the regulation according to which the data of persons applying for support, as provided for in these regulations, are to be made available to entities other than ZUS (Polish Social Insurance Institution) on the basis of an agreement. In the opinion of the Personal Data Protection Office, it appears that this will not be done on the basis of a legal provision, which is not an appropriate solution
All the supervisory authority's comments on the draft act and their in-depth analysis can be found in the President of the Personal Data Protection Office opinion attached below.
The opinion of the President of the Personal Data Protection Office regarding the government draft act on supporting parents in professional activity and in raising children - "Active Parent" is available in the file attached below.
