The Polish Data Protection Authority (UODO) has recently issued a decision questioning the validity of employee data processing authorisations that are created automatically by IT systems. In this specific case, the authorisations were generated by a platform after an employee completed data protection training and passed a knowledge test. While the decision is not yet final, it signals a potentially restrictive shift in how the regulator views automated compliance workflows.<\/p>\n
The authority raised several objections, including the absence of a signature from the employer\u2019s representative, the lack of identification of the authorised individual and a failure to specify the scope of authorisation.<\/p>\n
It is difficult to agree with the authority\u2019s position. The GDPR does not impose any specific form for granting authorisations; the written form results from specific labour law provisions and applies primarily to special categories of personal data. It remains to be seen how the Provincial Administrative Court (WSA) will rule if the decision is appealed.<\/p>\n
What should be done now if such systems are already in place? First and foremost, the scope of authorisation should be properly defined. Documents should not be generated in an identical form for all employees, but should reflect the categories of data and types of processing operations authorised. It is also essential that the authorisation clearly identifies the individual to whom it is granted, enabling the employer to demonstrate that authorisation has indeed been conferred on a specific employee.<\/p>\n