The Government took into account the comments of the PL SA in the draft law on e-registrations

The Government took into account the comments of the President of the Personal Data Protection Office in the draft law on e-registrations

The Government took into account the comments of the President of the Personal Data Protection Office in the draft amendment to the Act on health care services financed from public funds, which assumes the operation of a new ICT system, the so-called central electronic registration.

UODO President Mirosław Wróblewski pointed out that the proposed system will process personal data, including health data and biometric data, using a voice assistant. Therefore, in the opinion of the President of the Personal Data Protection Office, the requirements of the GDPR should be taken into account when designing regulations dedicated to e-registration.

With regard to the provision on the use of a voice assistant for central electronic registration – which was of concern to the President of the Personal Data Protection Office – it is to be noted with satisfaction that, in line with the comments of the President of the Personal Data Protection Office, the Ministry of Health clarified this provision by specifying the purpose of the data processing, the scope of the data, and by indicating that the processing of personal data with biometric features in connection with the recording of patient conversations with a voice assistant cannot be used for purposes of identification and verification of natural persons.

However, it should be stressed that the President of the Personal Data Protection Office, in a letter addressed to the Chair of the Health Committee in connection with the examination of the draft law at the sitting of the Sejm Committee, maintained some of the reservations set out in his original opinion, indicating that it is still appropriate to clarify some of the proposed regulations.

The comments of the President of the Personal Data Protection Office are still relevant, e.g. with regard to the need to regulate the methods and procedure for processing personal data using a voice assistant (e.g. with regard to the method of identifying the recipient), including their security, as well as with regard to the regulations concerning the exercise of the rights of natural persons, such as the rights to rectification, access to data, erasure of data and other instruments protecting the rights of natural persons, e.g. the right to obtain human intervention.

The President of the Personal Data Protection Office asked for comments to be taken into account at this stage of the legislative process in order to ensure the protection of personal health data processed in the proposed system.

At the meeting of the Sejm Health Committee, referring to further comments of the President of the Personal Data Protection Office, the Ministry of Health indicated that all comments were subject to detailed analyses at the stage of the government legislative process and resulted in a number of changes to the draft act in question.

The full content of the statement of the President of UODO is available here: DPNT.401.101.2025 (in Polish)