On February 21, 2019, the lower chamber of the Parliament adopted the law “implementing the GDPR". The Act provides in particular for amendments to the Labour Code and the Act on Social Benefit Fund.

The most important changes in the Labour Code:

• the employer has the right to request from a candidate for employment data regarding qualifications, education and the course of previous employment only if they are necessary to perform a particular type of job or a given position. This means that the request for such data will not be permitted regarding all candidates and the assessment of whether the data is really necessary is required; 
• data exceeding the catalog provided for in art. 221 k.p. can be processed on the basis of consent and the lack of its expression cannot result in negative consequences for the data subject;
• no permission to process data on convictions, even with the consent of the person concerned. Processing of the data will only be possible if it stems directly from the provisions (eg. in relation to people working with children);
• persons processing health related data are required to have written authorization to process them.

The most important changes to the Act on Social Benefit Fund:

• the employer will be able to require the employee to provide the data necessary to establish and grant benefits from the company social benefits fund, as well as to request that the data is documented;
• persons managing the fund, who therefore process health related data, must have a written authorization issued by the employer to process the data;
• the employer will be required to review the data at least once a calendar year and to delete data collected in relation with granting benefits if their further processing is unnecessary for the purpose for which they were collected.

Having the above in mind, we recommend:

• verifying that the data you collect is not excessive;
• preparing proper job descriptions, which will directly indicate the necessity to confirm the education, qualifications and course of previous employment;
• creating an adequate system for authorizing data processing;
• verifying and possibly modifying the procedures related to recruitment processes;
• training people involved in managing the social benefits fund and members of the social commission.

Our personal data protection team is at your disposal.