The President of the PL SA seeks to amend the provisions governing the role of the DPO in services

The President of the Personal Data Protection Office once again requested the Ministry of Interior and Administration to commencing work on amendment of the provisions relating to the role of the Data Protection Officers (DPO) in the services dealing with combating crime.

The previous statement of the President of the Personal Data Protection Office on the amendment of the provisions of the Act of 14 December 2018 on the protection of personal data processed in connection with preventing and combating crime was issued in 2022. At that time, the supervisory authority received assurances that the changes will be introduced in the next broader amendment of these provisions. However, the rules have not been amended. Polish regulations regarding the role of DPOs in services (e.g. police, city guards, border guards) still do not meet the requirements of the Law Enforcement Directive, writes Mirosław Wróblewski, President of the Personal Data Protection Office, to Marcin Kierwiński, Minister of the Interior and Administration.

The law in its current form contains erroneous solutions: provides for the possibility of entrusting the DPO with the responsibilities of the controller, i.e. carrying out both a DPIA and requesting prior consultation. Both carrying out a data protection impact assessment and requesting prior consultation are the tasks of the controller. The DPO is required to assist the controller in these tasks by providing, at the request of the controller, recommendations for a DPIA and to monitor its implementation.

The President of the Personal Data Protection Office points out that the current provisions concerning the tasks of the DPO in the services may lead to a conflict of interest on the part of the Data Protection Officer. The role of the person performing such a function is to support the controller in complying with and correctly applying the provisions on the protection of personal data, and not to serve it in the performance of its tasks.

The Polish legislation should also specify the scope of the data to be transmitted by the controller to the President of the Personal Data Protection Office as regards the notification of the Data Protection Officer (designation, revocation, updates concerning the DPO’s data).The President of the Personal Data Protection Office also points out that the Act on the protection of personal data processed in connection with the prevention and combating of crime also lacks provisions that would oblige the controller to notify the President of the Personal Data Protection Office of any change in data on the controller.

The full text of the letter of the President of the Personal Data Protection Office Mirosław Wróblewski to the Minister of the Interior and Administration Marcin Kierwiński is attached below.

DOL.413.11.2022

The Statement of the President of the Personal Data Protection Office addressed to the Ministry of the Interior and Administration (in Polish)