In May, a Labour Code amendment entered into force changing the rules on personal data processing. It finally gives employers clarity on how to comply with the GDPR.
Processing personal data without consent
Applicants
Following the amendment, the Labour Code now lists personal data employers may process without employees’ consent. Under Article 221 § 1 of the Labour Code, applicants may be asked for:
- first name or names and surname;
- date of birth;
- contact details chosen by the person;
- education;
- professional qualifications;
- previous employment history.
Not every occupation requires particular education, qualifications or experience. The legislature therefore prohibits processing information in the last three categories without the applicant’s consent where it is not necessary.
Employees
Employers will additionally request the following from employees:
- residential address;
- PESEL number or, if none, the type and number of an identity document;
- data concerning the employee and their children necessary for exercising specific employment-law rights;
- education;
- education and previous employment history, if not obtained during recruitment;
- payment account number.
Processing personal data outside the list
Under a separate legal provision
The new provisions allow employers to process applicants’ or employees’ personal data necessary to exercise a statutory right or fulfil a legal obligation. This means they need not obtain the data subject’s consent for those purposes.
On the basis of consent
With an applicant’s or employee’s consent, employers may process personal data under the general rules, except information about convictions. However, refusal of consent must not have adverse consequences for applicants or employees, including refusal of employment or termination of the employment contract.
Processing special categories of personal data
General rule
Employers may process special categories of personal data with employees’ consent, where employees provide the data on their own initiative. These categories include, for example, racial or ethnic origin, political opinions and religious or philosophical beliefs. Employers may be particularly concerned with trade union membership, biometric data and health data. Such data must be processed by persons authorised in writing, who are also required to keep the data confidential.
Biometric data
There are two exceptions to the above rule for biometric data. First, employers may process them to control access to particularly important information whose disclosure could cause harm. Secondly, they may do so to control access to premises requiring special protection.
Video surveillance
General principles
Employers may introduce surveillance of the workplace or surrounding areas where necessary, meaning the aim cannot be achieved by other means, to ensure employee safety, protect property, supervise production or safeguard information whose disclosure could cause harm. The purposes, scope and method must be set out in a collective agreement or workplace rules. Employers not required to adopt workplace rules and not covered by a collective agreement must issue a notice containing this information. Employees must also be informed two weeks before surveillance begins; new employees must be informed in writing before starting work. Monitored areas must be clearly marked at least one day before the system is activated.
Particular premises
The Labour Code prohibits surveillance of premises used by workplace trade union organisations. Exceptionally, with the consent of the union or employee representatives, employers may introduce surveillance in sanitary facilities, changing rooms, canteens and smoking rooms. This is possible if it does not infringe employees’ dignity or other personal rights, in particular by anonymising those present.
Retention
Employers may retain recordings for up to three months, unless they constitute evidence in proceedings or the employer learns that they may be evidence in proceedings conducted under the law. In the latter case, retention is extended until the final, binding decision. Recordings must then be destroyed unless a separate provision states otherwise.
Email monitoring
Where necessary, employers may monitor email, applying the general rules above as appropriate. The grounds are ensuring work organisation that enables full use of working time and proper use of the tools provided to employees.
For more information on the GDPR, see our article announcing the entry into force of EU data protection rules. We also recommend our article on the January 2019 changes to keeping and retaining employee records. The amended Labour Code can be downloaded from the Internet System of Legal Acts website. 
