Cybersecurity Policy Report, Children’s Data Protection Guidance Released by Polish DPA, (Aug 15, 2024)

By Tony Foley

The Polish data protection authority, Urzad Ochrony Danych Osobowych (UODO), released guidance yesterday on how the personal data protection principles in the European Union’s General Data Protection Regulation (GDPR) applied to the processing of children’s information and to apply the provisions of 2023 amendments to the Act on Counteracting Threats of Sexual Crime (the Kamilka Act). The new requirements are scheduled to take effect today.

The guidance notes that the new obligations under the Kamilka Act apply to bodies managing education systems and other specified institutions, as well as to the organizers of activities and entities providing hotel and tourist services or other accommodation services, as well as guardians. The amendments to the Kamilka Act requires such entities to obtain information about future employees or other participants in the entities’ activities, in particular with respect to their criminal record. UODO emphasized that data on employees and job candidates, as well as children, must be processed in accordance with personal data protection law.

UODO suggested that the entities affected by the Kamilka Act amendments should consider carrying out a risk assessment and verifying the data protection policies currently in force in the organization and the methods of implementing obligations arising from the GDPR, as well as adapting solutions to take a variety of factors into account in the context of the requirements of the amended act.

Specifically, organizations subject to the amendment’s requirements should verify and update, among other things, policies regarding information obligations towards data subjects and access authorizations for persons designated to have access to personal data and responsibility for carrying out tasks arising from the amendments.

The guidance also provides information on the UODO’s expectations regarding fulfilling these obligations, including meeting data minimization requirements, anonymization and pseudonymization options, and regularly checking the validity of access authorizations, among other recommendations.

News: InternationalLegislation DataPrivacy DataSecurity GDPR