Opinion of the President of the Personal Data Protection Office on the Act on maintaining cleanlines

The provisions of the Act on maintaining cleanliness and order in municipalities can be improved taking into account the standards of personal data protection.

Mirosław Wróblewski, the President of the Personal Data Protection Office, forwards the comments to the Ministry of Climate and Environment.

The problem concerns in particular Article 6o(1a) of the Act, which stipulates the verification of declarations submitted by property owners in connection with the obligation to pay a fee for municipal waste management. This provision was to provide municipalities with tools to verify the reliability of waste declarations submitted by residents of the municipality. However, it is so imprecise that it cannot not constitute a legal basis for obtaining data from entities other than property owners.

Therefore, the President of the Personal Data Protection Office welcomes the current proposal to amend this provision.

The proposed wording of Article 6o(1a), however, still does not meet the requirements of a properly shaped legal basis for the processing of personal data.

• It is still not a clear and precise provision laying down minimum requirements to ensure that persons whose personal data are processed have sufficient guarantees to effectively protect that data against the risk of misuse. Unfortunately, no DPIA was carried out during its drafting (data protection impact assessment, in accordance with Article 35(1) and (10) GDPR).
• As a result, the amendment proposes indicating who and for what purpose can obtain information needed to verify waste declarations. However, it does not specify the entities concerned (controllers) and does not oblige them to provide the required information or from which specific resources, registers, data will be obtained.
• Furthermore, the legislator has provided for an excessive scope of data to be processed in order to verify waste declarations. Only the number of people living at one address would suffice - not personal data in the form of names, surnames, personal identification number (PESEL number), address of residence, address and date of registration for permanent residence, address and date of registration for temporary stay and date of expiry of the declared period of stay, the amount of water used on the property.
• The draft provisions are insufficient in the context of the principle of lawfulness, and do not indicate the method of data processing, i.e., the procedure under which the verification of declarations will take place.
• The draft provision also does not specify specific guarantees or minimum criteria to ensure that the objectives of the regulation are reconciled with the requirements of the GDPR with regard to the application of data security measures (including ensuring cybersecurity), in particular preventing their loss or unlawful dissemination, as well as preventing access to data by unauthorised persons.
• There are also no provisions specifying the period of data storage by local government units in a form that allows the identification of the data subject.
• There are also no provisions specifying the period of data storage by local government units in a form that allows the identification of the data subject.

The President of the Personal Data Protection Office hopes that expert analysis will help in drafting of better law. He points out that he has considered the problem of waste declarations on a number of occasions and that the Office's experts have examined the matter in depth.

The analysis in its entirety is available in Polish under the reference number: DOL.401.514.2024