On August 21, 2023, the President of the Republic of Poland signed the Amending the Public Health Act and Certain Other Acts Act of August 17, 2023 [in Polish: ustawa z dnia 17 sierpnia 2023 r. o zmianie ustawy o zdrowiu publicznym oraz niektórych innych ustaw]. The provisions introduced in Chapter 6a to the Sport’s Act of June 25, 2010,[1] regulate the creation of a public database— “Sports talents.”

The new regulations introduce the collection of personal data of all students, including their sensitive data, covering a wide range of information, such as name, surname, PESEL number (and in the case of a student without PESEL number—name, surname, date of birth, series, and number of passport or another document confirming one’s identity), as well as year of birth, age gender, body weight, height, results of fitness tests and the date when they were made; the name and type of school the student attends or attended; the class and department the student attends or attended; the gmina, poviat and voivodeship in which the student obtained fitness test results.

Complaints regarding the „Sports talents” register

Due to incoming complaints addressed to the Commissioner for Human Rights regarding the “Sports talents” register, the Commissioner addressed the Minister of Education and Science concerning the doubts related to the newly created register.

The Commissioner indicated that:

(…) doubts as to how to ensure the proper protection of personal data processed in this register have arisen, as well as concerning the purposefulness and proportionality of some of the regulations proposed—from the perspective of the respect of the right to privacy and protection of personal data guaranteed in the Polish Constitution and the provisions of the regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC[2] [own bolding added].

The Commissioner’s objections concerned mainly: (i) overbroad scope of data processed, including identifying data as well as sensitive data collected in one place; (ii) high risk of compromising the security of children’s personal data because of unspecified group of subjects to which the data from Sports talents register is made available; (iii) possible breaches of data security that may result in students’ private lives being invaded; (iv) a need to create records for the goals indicated by the legislator; (v) the proportionality of the solution adopted, which allows the public authorities to collect the data, which will be used to select students based on criteria their physical fitness and suitability for practicing sports; (vi) the sole legislative process of introducing changes to the Act on sport.

The Opinion of the President of the Personal Data Protection Office

The President of the Personal Data Protection Office expressed his views concerning the Commissioner for Human Rights’s letter to the Minister of Education and Science.

What he emphasized in his letter is that:

The supervisory body was not involved in the legislative process regarding the private members’ bill project amending the Public Health Act and Certain Other Acts (Journal of Laws of the Republic of Poland, item 1718) [in Polish: Ustawa z dnia 17 sierpnia 2023 r. o zmianie ustawy o zdrowiu publicznym oraz niektórych innych ustaw]. Despite being aware that the draft concerned the processing of personal data on a large scale, the drafter did not submit the legislative proposal to the supervisory authority for an opinion on the proposed bill at a proper stage of legislative work. It should be remembered that the supervisory body has no legislative initiative, and its expert role in recommending solutions that consider EU law on the protection of personal data when creating specific legal norms can only be implemented if it is not omitted in the process of creating them. The practical application of the provisions raising doubts from the perspective of data protection law will be the subject of control and administrative proceedings conducted because of submitted complaints or due to an autonomous decision of the supervisory authority [3] [bolding added].

Experts’ critical voices

Experts are alarmed that the new regulations create legal problems. Professor G. Sibiga identified the following issues regarding the regulations introduced:

• questionable purposes of data processing, related to the created legal obligation that limits the informational autonomy of individuals – (data processing without parental consent and without the possibility to object effectively and to exercise the right to be forgotten);
• threats related to the fiction of anonymity of children’s data, especially in the case of small gminas with one school. Children’s data in small towns will allow the child to be identified;
• failure to carry out a regulatory impact assessment for the protection of personal data, as provided for in Art. 35(10) GDPR;
• in the future, the created registration database may be used for other purposes – e.g. army recruitment.

Summary

According to our Law Firm’s experts, the solutions proposed in the Act raise justified concerns in regards of ensuring the proper protection of personal data. Moreover, the President of the Personal Data Protection Office’s comments regarding the legislative process are justified and accurate—the involvement of specialized institutions in the process of drafting legislation by making opinions on it, especially on private members’ bill, generally improves the quality of the drafts an allows for an avoidance of incorrect legislative decisions.

[1] Journal of Laws of the Republic of Poland of 2022 r. items 1599 and 2185.

[2]https://bip.brpo.gov.pl/sites/default/files/202309/Do_MEiN_dzieci_sportowe_talenty_dane_osobowe_26.09.2023.pdf (access from: November 23, 2023).

[3]https://bip.brpo.gov.pl/sites/default/files/2023-10/Odpowiedz_PUODO_dzieci_sportowe_talenty_dane_osobowe_3.10.2023.pdf (access from: November 23, 2023).