Protecting personal data
Thanks in part to the adoption of the Access to Business Information Act earlier last year, part of the difficulty in investigating the truthfulness of a potential borrower's credit application, or for that matter, a potential business partner, has been resolved. Now, with the creation of agencies specialised in credit-reporting, creditors, and business in general, may access the credit history of a potential business partner or client. Notice, however, that the disclosure of information is limited to a person's (or company's) history of payments, and does not include the disclosure of personal information.
Other regulations govern the collection and dissemination of personal data, most notably the Personal Data Protection Act (DPA), which has been in force for several years, albeit amended from time to time. The DPA is intended to implement Council Directive 95/46/EC, designed to regulate the collection and dissemination of personal data. And this is vital: the DPA applies to personal data, not corporate data. In theory at least, your personal address should be protected by the DPA, while your business mailbox may remain open to junk mail.
How exactly does the DPA control the collection and dissemination of personal data? Specifically, the DPA requires any operator of a database in which personal information is stored to register such database with the Office of General Data Protection (the "GDP"). This registration requirement applies to all databases used for the purpose of processing personal information, such as a person's home address, age, marital status, etc. And it may be worth emphasising that the scope of the DPA includes not only electronic databases, but also "index card" databases, if such cards are used to collect personal data. As for enforcement, GDP officials are empowered to inspect your office, including you, your staff, computer servers and workstations, between the hours of 6 in the evening and 10 at night. The use of personal data stored in a database must be limited to such purpose as authorised by the individual on whom such data is collected. Failure to register a database in advance of setting it up, or the improper use of such stored information, may lead to the imposition of a monetary fine, or in extreme cases, imprisonment for up to one year.
This registration requirement seems a bit draconian. Any exceptions? Yes, the secret service may continue to collect and process personal information beyond the scope of the DPA (this wasn't the exception I was hoping for). Other exceptions apply to databases maintained by the police, judiciary, churches, medical professionals, lawyers and tax advisors, among others. Also, databases maintained exclusively for the purpose of invoicing customers are not subject to the registration requirement, nor are employee related databases. The wording of the DPA exempts employee databases from the registration requirement, but not the creation of databases that contain information on job applicants. The processing of information received from job applicants is, in general, subject to the registration requirement. Temporary databases or databases created for educational purposes, however, are not subject to the registration requirement. Specifically, Art. 2(3) of the DPA exempts such databases from the requirement in question if the information collected is deleted or otherwise modified to make the identity of such person anonymous, immediately after being processed. Unfortunately, what is meant by immediately is not defined in the DPA.
OK, so what about the actual dissemination of such personal data stored in a database? Can I, as a potential purchaser of a parcel of land, request and receive personal information regarding the owner from the local land registry? Can the clerk in the land records office refuse to provide me with such information?
Under the DPA, personal data maintained by administrative authorities may be provided to anybody, including myself as a future land owner, if I have a justified reason to obtain such information. This implied right, however, does not apply to "sensitive data", including, for example, a person's religious and political affiliations, medical records, or judicial actions taken against an individual. Additionally, and this gets a little confusing, the release of such information may not infringe upon the freedom of the person from whom I intend to purchase the property. Depending on where you are in Poland, this requirement has been subject to various interpretations by the local authorities. As for providing your justification to receive such information, such a request must be made in writing. The local clerk may, in the end, simply provide you with the appropriate number of the relevant land and mortgage book, in which case you will then need to visit the local courthouse to retrieve the information yourself.
Alexander Deptula is an associate with Miller, Canfield, W. Babicki & Partners.
Other regulations govern the collection and dissemination of personal data, most notably the Personal Data Protection Act (DPA), which has been in force for several years, albeit amended from time to time. The DPA is intended to implement Council Directive 95/46/EC, designed to regulate the collection and dissemination of personal data. And this is vital: the DPA applies to personal data, not corporate data. In theory at least, your personal address should be protected by the DPA, while your business mailbox may remain open to junk mail.
How exactly does the DPA control the collection and dissemination of personal data? Specifically, the DPA requires any operator of a database in which personal information is stored to register such database with the Office of General Data Protection (the "GDP"). This registration requirement applies to all databases used for the purpose of processing personal information, such as a person's home address, age, marital status, etc. And it may be worth emphasising that the scope of the DPA includes not only electronic databases, but also "index card" databases, if such cards are used to collect personal data. As for enforcement, GDP officials are empowered to inspect your office, including you, your staff, computer servers and workstations, between the hours of 6 in the evening and 10 at night. The use of personal data stored in a database must be limited to such purpose as authorised by the individual on whom such data is collected. Failure to register a database in advance of setting it up, or the improper use of such stored information, may lead to the imposition of a monetary fine, or in extreme cases, imprisonment for up to one year.
This registration requirement seems a bit draconian. Any exceptions? Yes, the secret service may continue to collect and process personal information beyond the scope of the DPA (this wasn't the exception I was hoping for). Other exceptions apply to databases maintained by the police, judiciary, churches, medical professionals, lawyers and tax advisors, among others. Also, databases maintained exclusively for the purpose of invoicing customers are not subject to the registration requirement, nor are employee related databases. The wording of the DPA exempts employee databases from the registration requirement, but not the creation of databases that contain information on job applicants. The processing of information received from job applicants is, in general, subject to the registration requirement. Temporary databases or databases created for educational purposes, however, are not subject to the registration requirement. Specifically, Art. 2(3) of the DPA exempts such databases from the requirement in question if the information collected is deleted or otherwise modified to make the identity of such person anonymous, immediately after being processed. Unfortunately, what is meant by immediately is not defined in the DPA.
OK, so what about the actual dissemination of such personal data stored in a database? Can I, as a potential purchaser of a parcel of land, request and receive personal information regarding the owner from the local land registry? Can the clerk in the land records office refuse to provide me with such information?
Under the DPA, personal data maintained by administrative authorities may be provided to anybody, including myself as a future land owner, if I have a justified reason to obtain such information. This implied right, however, does not apply to "sensitive data", including, for example, a person's religious and political affiliations, medical records, or judicial actions taken against an individual. Additionally, and this gets a little confusing, the release of such information may not infringe upon the freedom of the person from whom I intend to purchase the property. Depending on where you are in Poland, this requirement has been subject to various interpretations by the local authorities. As for providing your justification to receive such information, such a request must be made in writing. The local clerk may, in the end, simply provide you with the appropriate number of the relevant land and mortgage book, in which case you will then need to visit the local courthouse to retrieve the information yourself.
Alexander Deptula is an associate with Miller, Canfield, W. Babicki & Partners.
