Activities of Poczta Polska may threaten protection of citizens 'data: Ombudsman

Adam Bodnar, the Ombudsman asks the prime minister on what basis Poczta Polska is asking local governments to provide voters' lists; also wants to clearly indicate the company's tasks and responsibilities related to the organization of elections. On Friday, Adam Bodnar addressed a letter to Mateusz Morawiecki regarding this matter.

In a letter to the prime minister, Bodnar emphasized that he had carefully received information about the activities of Poczta Polska. He referred to the position of the Association of Polish Cities, in which it was indicated that the Electoral Code or any other law did not provide for the participation of Poczta Polska in the implementation of tasks related to the organization of elections, requiring disclosure of data.

The Ombudsman noted that there is a lack of an appropriate legal framework to provide Poczta Polska with data from voter registers, which threatens the protection of individual privacy.

"As the basis for its conclusions, Poczta Polska cites Article 99 of the Act of 16 April 2020 on specific support instruments in connection with the spread of the SARS-CoV-2 virus, as well as the decision of the Prime Minister of 16 April 2020 (regarding Poczta Polska SA acts necessary to prepare for the election of the President of the Republic of Poland in 2020.) This raises fundamental doubts. This provision allows the transfer of data of all citizens without adequate safeguards, from various sources, and for very broad purposes.” Bodnar said.

Bodnar also quoted the opinion of the Krakow Institute of Criminal Law, according to which "the order to hand over to the Polish Post Office the list of voters in legal status on April 23, 2020, has no legal basis and may bear the hallmarks of a crime".

The Ombudsman also pointed out that there are very serious doubts about the security of the transfer of personal data. At the same time, he points to the information provided by the CERT Polska government team.

 "Analysis of the headers of sent emails indicates that these messages were actually sent from the servers used by Poczta Polska. From the perspective of communication security problems, the message lacks a digital signature confirming the sender's identity. With this in mind, we suggest verifying the content of the application through independent channels and conducting appropriate risk analysis as to the scope and manner of transferring data "- CERT Polska assessed.

(PAP)