The President of the Office for Personal Data Protection (UODO) has issued warnings to four public institutions for illegally processing the personal data of scientists from the POL-on database, with the aim of creating an analysis of the level of COVID-19 vaccination among Polish universities. This decision was a result of a complaint lodged by a citizen – a scientist working at one of the universities.
How did the breach occur?
As a part of cooperation between the Ministry of Education and Science (MEiN) and the Ministry of Health (MZ), the e-Health Centre was provided with personal data from the POL-on database. This information included, among other things, personal identification numbers (PESEL) and the statuses of individuals (student, doctoral student, university employee), and data identifying universities. This data was compared with data from the P1 system (Electronic Platform for Collecting, Analysis, and Sharing Digital Resources about Medical Events) to create a statistical breakdown of vaccination levels at universities.
As a result of this process, statistical data was created that included the name of universities, groups (students, doctoral students, employees), vaccination level in each group (no vaccination, one dose, full dose), and the number of people in each category. The e-Health Centre transferred this data to the MEiN, and the Information Processing Centre (OPI) published it on their website.
No legal basis
As the President of UODO highlighted, such operation was against the law. The personal data of scientists from the POL-on database and information from the P1 system were processed for purposes that went beyond the scope for which they were originally collected. The transfer of personal data had no appropriate legal basis, which constitutes a violation of personal data protection regulations.
The cooperation agreement concluded on 21st December 2021 between MEiN and MZ does not change the fact that the purposes of processing data in the POL-on and SIM (Medical Information System, part of the P1 system) systems are defined in the appropriate laws and do not include actions such as creating statistical analyses about vaccinations.
Decision of Provincial Administrative Court: Upholding UODO’s stance
The e-Health Centre, disagreeing with the decision of the President of the UODO, lodged a complaint with the Provincial Administrative Court (WSA). However, with a judgement from 14th January 2025, the court upheld UODO’s decision, concluding that there had been no legal basis for processing the data. The justification for the decision has not yet been published.
Source: https://managerplus.pl/nielegalne-przetwarzanie-danych-z-bazy-pol-on-w-celu-analizy-szczepien-na-uczelniach-decyzja-uodo-92883
