PolandGDPR Article 9, Act Article 107(2), and Kodeks Pracy Article 22(1b), Biometric Data
Regulation (EU) 2016/679, Art. 9; Ustawa z 10 maja 2018 r., Art. 107(2); Kodeks pracy, Art. 22(1b)
In force since .
A biometric privacy rule binding public and private bodies.
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- none
What it requires
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric data of a person in Poland.NIST Privacy FrameworkCT.PO-P1
- Rely on a Polish employee's consent to process their biometric data only where the employee supplied the data on their own initiative, and let only people you have authorized in writing process it, bound to confidentiality, under Kodeks pracy Article 22(1b); processing needed to control access to particularly important information or to premises that need special protection is also permitted under Article 22(1b).NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkPR.AC-P4
These lines are LexLint's reading of the law's text. Also read by: Urząd Ochrony Danych Osobowych (UODO) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- PR.AC-P4Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://uodo.gov.pl/file/1469
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of (Grand Chamber)
- Guidance body
- Urząd Ochrony Danych Osobowych (UODO)
- Open questions
- Does the rule in the October 2018 UODO employer guide against biometric working-time records 'nawet za zgodą' (even with the employee's consent) still hold after Article 22(1b) of the Labour Code allowed an employer to rely on consent where the employee supplies the data on his or her own initiative?
- Which information counts as 'szczególnie ważnych informacji, których ujawnienie może narazić pracodawcę na szkodę' (particularly important information whose disclosure could harm the employer), and which premises as 'pomieszczeń wymagających szczególnej ochrony' (premises requiring special protection), under Article 22(1b)(2) of the Labour Code?
What it makes you log
Logging duty
Article 9(1) prohibits processing of special categories of data, including biometric data used to identify a person. Act Article 107(2) raises the criminal penalty for unlawful processing of those categories. Kodeks pracy Article 22(1b) lets only persons holding the employer's written authorization process an employee's biometric data; that is a document of authorization and not a log of access.
- Kind
- None
- As of
What this law does
General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category.
Poland's own Act Article 107(2) independently names biometric data processed for unambiguous identification as one of the aggravating categories that raises the criminal penalty ceiling for unlawful processing from two to three years' deprivation of liberty, alongside racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health data, and sexual life or orientation data.
Article 107(2) took effect with the rest of the Act on (Article 176). For employees specifically, Kodeks pracy Article 22(1b) lets an employer rely on consent to process an employee's biometric data only where the employee supplied the data on their own initiative.
It also permits an employer to process an employee's biometric data where that is necessary to control access to particularly important information whose disclosure could harm the employer, or to premises that need special protection. Only persons holding the employer's written authorization may process such data, and they must keep it confidential. Article 4 of the Act of (Journal of Laws 2019, item 730) inserted Article 22(1b) into Kodeks pracy. That Act entered into force on , the day after the 14 days that run from its announcement on .
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .