On 4 May 2019 new provisions of the Polish Labour Code came into force which introduced significant changes to the rules of collecting personal data of candidates and employees.

One of the most important changes concerns collecting and processing sensitive personal data of employees. According to the new rules, the employer may collect and process sensitive data such as data revealing racial or ethnic origin, political views, religious or ideological beliefs, trade union membership and genetic data, biometric data to uniquely identify a person or data on health, sexuality or sexual orientation only when candidate or employee provides it at his/her own initiative. This means that the employer cannot collect such data during recruitment process for example by asking a candidate questions regarding them.

Importantly, new provisions establish also a principle that the biometric data of the employee may be processed also in connection with the employer’s need to control the access to the particular sensitive data which when disclosed could lead to the employer’s damage or when it is necessary to protect access to rooms which require special protection which gives some employers possibility to collect biometric data of the employees also at the request.

In connection with coming into force of new provisions, we recommend introducing changes to the internal bylaws regulating recruitment procedures as well as verifying other internal policies in terms of collecting and processing personal data in order to check whether they are in line with the statutory provisions.