What will the European General Data Protection Regulation change with regard to personal data of employees?

blog wierzbowski eversheds sutherlandAt the end of May 2018, the European General Data Protection Regulation will replace the current directive regulating this issue as well as the current Polish Personal Data Protection Act. The changes will also impact laws of the processing of personal data of employees. The draft of the Act – Provisions introducing the new general data protection act was published on 12 September 2017.

The amendments to provisions concerning the processing of personal data of employees were long expected by employers. The current legal status has often failed to meet the demands and realities of the contemporary employment relationship. Also, the conservative judgments of some courts which challenged the legal effects of the employee's consent to the processing of certain personal data were not helping.

Current legislation, specifically art. 22 (1) §1 of the Labor Code provides that the employer may require the job applicant (or employee) to give his full name, parents' full names, date of birth, place of residence and address for correspondence, education, current employment history.

In addition, §2 of this Article allows the employer to request other personal data of the employee, such as the names and dates of birth of the employee's children, if such information is required because the employee is exercising special entitlements under the labor law. In addition, the employer may also request the PESEL number.

In the case of other personal data, the Labor Code allows their request, provided that the obligation to supply them to the employer results from other provisions of the law.

The planned changes largely meet the expectations of employers, inter alia, by updating the list of data that can be requested from employees. Pursuant to the new art. 22 (1) §1 of the Labor Code, the employer will still be able to require: employee's full name, date of birth, address for correspondence, education, current employment history. The novelty is to add an email address or phone number to this list, while removing the name of the employee's parents.

Moreover, if the employee does not have a PESEL number, the employer will be able to demand the type and number of the employee's identification document.

However, the most important change will result from the newly added art. 22 (2) §1 of the Labor Code. This provision expressis verbis allows for the processing of other data of the employee or job applicants, than those listed in art. 22 (1) §1 and 2, if the employee or the job applicant agrees to it in writing or electronically and simultaneously, if the data relates to the employment relationship. In the case of biometric data, the employer will be able to process them if they relate to the employment relationship and only with regards to employees, and therefore not to job applicants. The processing of biometric data will be subject to the consent of the employee. The exception to this new rule will be personal data relating to addictions, health, sexuality and sexual orientation of an employee or job applicant. The employer will not be allowed to process this data, even if the employee (job applicant) has consented to it.

Another novelty in the Labor Code will be art. 22 (4), which will provide a legal basis for monitoring employees. Pursuant to it, the monitoring can be used to ensure the safety of employees, or to protect property, or keep confidential information disclosure of which could expose the employer to damages. It is prohibited to use monitoring in order to control the performance of work by employees as well as to monitor rooms where work is not carried out, e.g. sanitary rooms, locker rooms, canteens or smoking rooms.

One may have doubts as to the manner in which the provision prohibiting monitoring in non-work premises was formulated. While it is reasonable for sanitary and locker rooms, monitoring halls and corridors, entries and exits, to and from the rooms and buildings as well as canteens and smoking rooms is rather not an overly intrusive interference into the employee’s private sphere. On the other hand the lack of monitoring capabilities in these locations can create serious gaps in the protection systems used by employers.

The envisaged changes are currently being worked out at the Ministry of Digitization. This is only the beginning of the legislative path, so it is difficult to predict whether they will come into force in the current shape. It may now be assumed that the new provisions should be in force in May 2018, as the new European General Data Protection Regulation is planned to come into effect at the end of May.

Get the updates

Enter your email address to subscribe to this blog and receive notifications of new posts to your inbox.

About the blog

We discuss the current labour law, legal judgments and interpretations issued
by the National Labor Inspectorate and the Polish Ministry of Labour and Social Policy.


We follow and comment on legislation and refer to the current problems
in the field of Polish labour law.

Check this out

Social Media
European employment approach 

Click here
for detailed information on the use
of Social Media across European jurisdictions.

About the authors