Ministry of the Interior and Administration responds to the Personal Data Protection Office President’s concerns over the collection of police officers’ data

In July 2026, President of the Personal Data Protection Office Mirosław Wróblewski wrote to the Minister of the Interior and Administration, highlighting the need to clarify the data retention framework applicable to Police officers and employees. The issue concerned biometric and genetic data, namely fingerprints and oral swabs. In the President’s view, the current method of collecting and storing such data failed to meet constitutional and EU standards. The Ministry is currently analysing the concerns raised by the President of the Personal Data Protection Office.

In the letter, Mirosław Wróblewski called for amendments to the provisions governing the collection of such data. He pointed out that the current legislation may infringe constitutional safeguards under which the right to informational self-determination may only be restricted by statute. The President of the Personal Data Protection Office also highlighted a possible breach of the data minimisation principle due to the introduction of a fixed five-year retention period after an individual’s employment or service has ended. Such a solution is not fully consistent with the standards established in the case law of the Court of Justice of the European Union (CJEU). Particular doubts concern whether retaining former police officers’ data complies with the principle of “strict necessity” arising from the data minimisation requirement.

The scope of persons from whom data is collected is limited

At the outset, the Ministry of the Interior and Administration pointed out that the current wording of Article 20(1l) of the Police Act — which was the subject of the President of the Personal Data Protection Office’s concerns — does not confer a general power to collect data from all Police officers and employees. It applies only to persons who “perform official duties involving the identification, securing and examination of traces connected with a suspected criminal offence”. According to the Ministry, the collection of this specific data is necessary to distinguish traces left on evidence by persons lawfully performing official duties from traces left by other individuals and, potentially, by perpetrators of offences.

According to the Ministry’s response, the mechanism is intended to safeguard the proper conduct of criminal proceedings and the authenticity and evidential value of traces, while also reducing the risk of wrongly attributing traces to an unauthorised person. It is therefore connected with the performance of the Police’s core duties and applies only to a strictly defined group of individuals.

Statutes need only regulate the most important matters

The Ministry of the Interior and Administration also disagreed with the Personal Data Protection Office’s view that the method of collecting this data had not been regulated by statute. Mirosław Wróblewski had noted that, although the collection of the data itself has a statutory basis, important matters that interfere with the right to privacy are regulated by a regulation, i.e. secondary legislation. In his view, this is contrary to the constitutional principle of informational self-determination, under which an individual may only be required by statute to disclose information concerning themselves.

According to the Ministry, it does not follow from this wording of the constitutional provisions that every technical aspect of collecting and processing data must be specified at statutory level. In the Ministry’s view, it is sufficient for the statute to regulate the fundamental matters, namely the personal and material scope of the provision, the nature of the data collected and the purpose for which it is collected — all of which, it argues, are provided for under the current legal framework.

In the letter under discussion, the Ministry argued that the legislation already regulates these matters with sufficient precision by identifying the category of persons from whom data may be collected (Police officers and employees); the type of duties they perform (identification, securing and examination of traces); and their connection with a suspected criminal offence. The Ministry added that the purpose of collecting such data is also sufficiently clear, namely to eliminate traces left by persons carrying out official duties. According to the Ministry, the current provisions cannot therefore be regarded as insufficiently precise or as requiring further clarification.

Data minimisation does not preclude a five-year retention period

The Ministry also rejected the allegation that the data minimisation principle is breached by setting a five-year retention period for the data after the end of employment or service. Such a period is justified, it argued, by the need to ensure continuity and effectiveness in investigative and procedural activities, particularly where a police officer has performed such duties over an extended period. The letter emphasised that, during the five-year period, the data may be used solely for the purpose for which it was collected. There can therefore be no question of its unconditional or uncontrolled retention. The Ministry also stressed that the requirement to regularly assess whether retaining the data remains justified cannot mean that an individual justification must be provided in every case from the very beginning of the retention period.

In the Ministry’s view, it cannot be assumed in advance that retaining the data is disproportionate to the purpose it serves or that it lacks the quality of “strict necessity”. The latter is required by the data minimisation principle under the GDPR, as the President of the Personal Data Protection Office pointed out in his letter. According to the Ministry, the CJEU’s case law — which was also cited by the President of the Personal Data Protection Office — does not establish a general prohibition on Member States introducing arrangements providing for the collection of biometric data from specified categories of persons. Such cases should instead be assessed with regard to the purpose of processing, the scope of the rules and the categories of persons covered by them, as well as the safeguards applied.

Ministry announces review of whether the legislation needs clarification

The Ministry added that it is analysing the concerns raised by the President of the Personal Data Protection Office to determine whether legislative amendments are in fact necessary to clarify these issues. The analysis will take into account both the wording of the legislation and the way in which the provisions operate in practice. As part of the review, the Ministry will examine the justification for and scope of any potential amendments, their impact on the protection of data subjects’ rights, and the need to maintain a balance between the performance of public tasks and respect for the principles of proportionality, legality and minimisation of interference with individual rights.