Impact of the GDPR on the rules for processing data relating to employees using a company social benefits fund
- Posted by Mateusz Gajda
Employees wishing to take advantage of benefits financed by a company social benefits fund are usually required to provide additional information about their life, family and material situation. The amendment to the Act on Company Social Benefits Funds from May 2019 allows employers to process additional information on employees and their families for the purpose of granting benefits from the fund, such as information on the number of family members living in the same domicile and the average income per family member.
At the same time, the amendment has introduced additional rules for processing personal data of employees entitled to use the fund that should be reflected in the fund’s regulations.
A key change in this respect is the introduction of the obligation of the employee to provide the employer with information on his/her difficult situation in the form of a written statement. Of course, before making a decision about granting a benefit and the amount thereof, the employer may also request that the employee provide documentation confirming the information provided in the statement (e.g. his/her annual tax declaration).
In the situation in which the basis for granting a benefit is information about an employee’s health, the new provisions provide that only persons with authorization in writing issued by the employer may have access to such information.
Period of storage of personal data
The new regulations do not specify a maximum period for storing personal data of employees made available to the employer in connection with claiming benefits from the fund. In theory, an employer may process such data only for the period necessary to grant a concessional service and benefit or a subsidy from the fund, to determine the amount thereof, and for the period necessary to assert rights or claims. In practice, taking into account the possibility of the Social Insurance Institution or the tax authorities challenging the decision to grant a benefit, it seems that the employer may process the data that became the basis for the decision to grant a benefit for a period of five years. However, employers should bear in mind that under the new provisions, they are required to review their personal data annually to determine the need for further storage, which in practice means that they should keep the personal data provided to them to a limited extent.
In connection with the entry into force of the new regulations, we recommend that you adjust the regulations of the company social benefits fund and also review the catalogue of data that you process in connection with the operation of the fund.