Statement by the President of the UODO on obtaining personal data of voters by a postal operator
In connection with repeated questions and doubts addressed to the supervisory authority regarding the collection of personal data of voters by the postal operator in order to organize the election of the President of the Republic of Poland, the President of the Personal Data Protection Office presents his position on the matter.
In the Polish legal system, the National Election Commission plays a key role in the organization of the election. The tasks of the National Election Commission in accordance with Art. 160 § 1 of the Election Code should include supervising the compliance with electoral law and supervising the keeping and updating the electoral register and preparing the voter lists. In the light of the applicable law, it is the National Election Commission, not the President of the Personal Data Protection Office, that is responsible for the proper conduct of the election of the President of the Republic of Poland.
The President of the UODO would like to point out that we operate in a specific period of pandemic, in which many state authorities try to ensure their normal functioning, as far as possible. For that purpose, the so-called Special Act was enacted which regulates many aspects of our lives during a pandemic.
In accordance with Art. 99 of the Act of April 16, 2020, in force since April 18, 2020, on special support instruments in connection with the spread of the SARS-CoV-2 virus (Journal of Laws, item 695), designated operator within the meaning of the Act of November 23, 2012 - the postal law, after submitting an application in electronic form, receives data from the PESEL register, or from another census or register at the disposal of a public administration authority, if these data are needed to carry out tasks related to the organization of the election of the President of the Republic of Poland or to perform other obligations imposed by government administration authorities. The data referred to in the first sentence shall be forwarded to the designated operator in electronic form within a maximum of 2 working days from the date of receipt of the application. The designated operator is entitled to process data only for the purpose for which it had received the data.
It follows from the above law that the postal operator is entitled to obtain from the public administration authority the personal data indicated by above legal provision, if one of the two independent conditions occurs. In the first case, sharing the data is possible if the data are needed to carry out tasks related to the organization of the election of the President of the Republic of Poland. However, in the second case, the disclosure of the data is possible if the data are needed to perform other obligations imposed by government administration authorities. There is no doubt that the first condition in the current legal status does not exist.
In connection with the introduction of the above provision of law, the National Election Commission, which in accordance with Art. 157 § 1 of the Act of 5 January 2011 - Election Code (Journal of Laws of 2019, item 684 and 1504 and of 2020, item 568, 695), hereinafter: the Election Code, is the permanent highest electoral body competent in matters of conducting elections and referendums, took a position defining the role of the postal operator, as well as the obligation to cooperate with postal operator in providing access to data from the voter list.
From the above position it follows that in the legal transactions there is a decision of a government administration authority, a copy of which in the opinion of the National Election Commission should be attached to the application of the designated operator (the operator referred to the decision of the Prime Minister of April 16, 2020 in the content of the applications), imposing the obligation referred to in Article 99 of the Act on specific support instruments in connection with the spread of the SARS-CoV-2 virus, for the implementation of which it is necessary to obtain personal data by a postal operator, and thus it should be considered that there is a legal basis for making such data available to the postal operator, provided that the application of the operator for disclosure of data meets the requirements as to form set out in above legal provisions. According to Art. 6(1)(c) of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation ) (Official Journal of the EU L 119 of 04/05/2016, p. 1, as amended), hereinafter: GDPR, processing is lawful if it is necessary for compliance with a legal obligation to which the controller is subject.
It should also be noted that the President of the Personal Data Protection Office emphasizes the role of the principles of personal data protection indicated in Art. 5 of the GDPR. The provision of Art. 5(1)(f) of the GDPR clearly states that personal data must be processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organizational measures (‘integrity and confidentiality’). Both entities obliged to provide personal data and the designated operator should ensure a high standard of security of IT systems used to process this data in order to minimize the risk of their unlawful disclosure. In order to eliminate the risk of violation of the rights and freedoms of voters participating in the election, adequate organizational measures should be implemented to ensure a level of security appropriate to this risk.
The President of the Personal Data Protection Office will monitor the entire process, cooperate with data protection officers, and in the event of data breaches take appropriate measures against data controllers.
 Letter of Mr Sylwester Marciniak, Chairman of the National Election Commission of April 23, 2020 (reference number: ZPOW-421-10 / 20) addressed to election commissioners to provide explanations to commune mayors, mayors and city presidents – available (in Polish) at: https: // samorzad.pap.pl/kategoria/aktualnosci/pilne-wyjasnienia-pkw-dotyczace-przekazania-spisow-wyborcow (access: 24.04.2020).
 The change to the said regulation was announced in the Official Journal of the EU L 127, 23/05/2018, p. 2.