What Needs to be Done Prior to Collection

Contact the data subject

Contact the Generalny Inspektor Ochrony Danych Osobowych

Article 24

1. In case where personal data is collected from the data subject, the controller is obliged to provide a data subject from whom the data are collected with the following information:

1) the address of its seat and its full name, and in case the controller is a natural person about the address of his/her residence and his/her full name,

2) the purpose of data collection, and, in particular, about the data recipients or categories of recipients, if known at the date of collecting,

3) the existence of the data subject’s right of access to his/her data and the right to rectify these data,

4) whether the replies to the questions are obligatory or voluntary, and in case of existence of the obligation about its legal basis.

2. The paragraph 1 shall not apply if:

1) any provision of other law allows for personal data processing without a disclosure of the real purpose for which the data are collected,

2) the data subject already has the information referred to in paragraph 1.

Article 25

1. In case where the data has not been obtained from the data subject, the controller is obliged to provide the data subject, immediately after the recording of his/her personal data, with the following information:

1) the address of its seat and its full name, and in case the controller is a natural person about the address of his/her residence and his/her full name,

2) the purpose and the scope of data collection, and in particular, about the data recipients or categories of recipients,

3) the source of data,

4) the existence of the data subject’s right of access to his/her data and the right to rectify these data,

5) the powers resulting from Article 32 paragraph 1 point 7 and 8.

2. The provisions of paragraph 1 shall not apply where:

1) the provision of other law provides or allows for personal data collection without the need to notify the data subject,

2) deleted,

3) the data is necessary for scientific, didactic, historical, statistic or public opinion research, the processing of such data does not violate the rights or freedoms of the data subject, and the fulfilment of the terms and conditions determined by paragraph 1 would involve disproportionate efforts or endanger the success of the research,

4) deleted,

5) the data is processed by the controller referred to in Article 3 paragraph 1 and Article 3 paragraph 2 point 1 on the basis of legal provisions,

6) the data subject already has the information referred toin paragraph 1.

Contact the Generalny Inspektor Ochrony Danych Osobowych

Registration of Personal Data Filing Systems

Article 40

The controller shall be obliged to notify a data filing system for registration by the Inspector General. The above shall not apply in cases referred to in Article 43 paragraph 1.

Article 41

1. The notification, concerning the data filing system submitted for registration, should contain the following:

1) an application for entering the personal data filing system into the register of filing systems,

2) an indication of the subject running the filing system and the address of its seat or place of residence, including the identification number in the register of enterprises setting up in business, if applicable, and the legal grounds on which he/she is authorised to run the data filing system, and in case of the subject referred to in Article 31a, indication of this subject and the address of its seat or place of residence,

3) the purpose of the processing of data,

3a) description of the categories of data subjects and the scope of the processed data,

4) information on the ways and means of data collection and disclosure,

4a) information on the recipients or categories of recipients to whom the data may be transferred,

5) the description of technical and organizational measures applied for the purposes referred to in Article 36 to 39,

6) information on the ways and means of fulfilling technical and organizational conditions specified in the provisions referred to in Article 39a,

7) information relating to a possible data transfer to a third country.

2. The controller shall be obliged to notify the Inspector General about any changes affecting the information referred to in paragraph 1, within 30 days following the date of the change introduced to the filing system. The provisions on registration of personal data filing systems shall apply respectively to the notification about changes.

Article 43

1. The obligation to register data filing systems shall not apply to the controllers of such data which:

1) constitutes a state secret due to the reasons of state defence or security, protection of human life and health, property, security, or public order,

1a) was collected as a result of inquiry procedures held by officers of the bodies authorized to conduct such inquiries,

2) is processed by relevant bodies for the purpose of court proceedings and on the basis of the provisions on National Criminal Register,

2a) is processed by the Inspector General of Financial Information,

3) relates to the members of churches or other religious unions with an established legal status, being processed for the purposes of these churches or religious unions,

4) is processed in connection with the employment by the controller or providing services for the controller on the grounds of civil law contracts, and also refer to the controller’s members and trainees,

5) refers to the persons availing themselves of their health care services, notarial or legal advice, patent agent, tax consultant or auditor services,

6) is created on the basis of electoral regulations concerning the Diet, Senate, European Parliament, communal councils, poviat councils and voivodship regional councils, the President of the Republic of Poland, head of the commune, major or president of a city elections, and the acts on referendum and municipal referendum,

7) refers to persons deprived of freedom under the relevant law within the scope required for carrying out the provisional detention or deprivation of freedom,

8) is processed for the purpose of issuing an invoice, a bill or for accounting purposes,

9) is publicly available,

10) is processed to prepare a thesis required to graduate from a university or be granted a degree,

11) is processed with regard to minor current everyday affairs.

2. As regards data filing systems referred to in Article 43 paragraph 1 point 1 and 3 and those referred to in Article 43 paragraph 1 point 1a processed by Internal Security Agency, Foreign Intelligence Agency, Central Anticorruption Bureau and Military Information Services the Inspector General is not entitled to the powers stipulated in Article 12 point 2 and Article 14 point 1, 3 to 5 and Articles 15 to 18.