Government prepares a new personal data protection law act
Government Information Centre issued a press release informing that work on the new act on the protection of personal data has been finished. The government of Mateusz Morawiecki is done with preparing the regulations which will adapt Polish legal environment to EU personal data protection requirements, in particular the General Data Protection Regulation (GDPR), the successor of the Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data. The new law is expected to come into effect in May.
The upcoming regulations will affect any entities that collect and process personal data. This means all Polish companies that have personnel files or keep databases containing information (e.g. addresses) collected from their clients. In practice, the law will apply to virtually all enterprises in Poland. Business owners need to take appropriate measures to meet the compliance obligations and adapt their internal rules with respect to data processing. To avoid the possibility of being granted a penalty, many companies in Poland decide to use the services of advisors offering services in this field.
Businesses will need to make it possible for their clients to request a complete removal of their personal data from the company’s internal system or moving them to a different entity. Any breach in the system that could cause threat to the rights and freedoms of individuals will have to be reported. Companies will be directly responsible for handling and processing personal data. Big entities, i.e. those employing over 250 staff members, will be obliged to record all operations related to personal data processing. Entrepreneurs who will not meet the obligations will face heavy money penalties.
The goal of the new law is asserting better protection of personal data of individuals across the EU. The Data Protection Directive will come into effect on 25 May 2018.