The clarifications of regulations considering the scope of data processing while incorporating the principle of data minimization – these are the main concerns of Miroslaw Wróblewski, Head of the Office for the Protection of Personal Data (UODO), concerning the proposed changes to the act on foreigners.
The Head of the UODO has included his reservations about the amendment to the law on foreigners in a letter to Maciej Duszczyk, Deputy Minister of Internal Affairs and Administration.
According to Miroslaw Wróblewski, some proposed changes are not sufficiently justified, especially in the context of personal data processing. For instance, the reason for introducing a 12-year retention period of foreigners’ data in the IT system Module for Matter Handling isn’t clarified. Also, it is uncertain why they have to provide information about their travel documents or identity documents. The Head of the UODO highlights that different documents may have different ranges of data. Until now, it was enough to provide only the number of such a document. Therefore, it is unclear why the obligations in this regard have been expanded.
The UODO points out that the proposal to introduce an IT system, the Module for Matter Handling, obliges the legislator to carry out a privacy test during the law-making process, including the data protection impact assessment, as stated in Article 35 of the GDPR. Such a test allows to assess risks and to choose appropriate legal measures to eliminate any violations of the rights or freedoms of individuals. This test should be carried out when creating provisions regulating data processing, especially when using new technologies that present a high risk to the rights and freedoms of data subjects due to the nature, scope, context and purpose of processing.
Miroslaw Wróblewski indicates that the introduced requirement of presenting “additional evidence, that the entry and stay in the territory of the Republic of Poland is for the purpose of conducting professional activities” is ambiguous. There is a concern about what the “additional evidence” should be and consequently, what personal data derived from its content should confirm the professional activities conducted. The UODO recommends specifying what documents could serve as evidence in such cases. Also, how the obligation to provide evidence should be executed, particularly how personal data will be collected.
