The Personal Data Protection Office has adopted a position regarding informing companies about the processing of personal data. It requires companies to inform the CEOs of companies with whom they enter into contracts that their personal data will be processed. Therefore, Articles 13 and 14 of the GDPR should be applied in situations where the data of individuals authorized to represent companies appear in documentation. These changes could entail significant costs. This is a significant change in the UODO's previous position.
Article 13 of the GDPR stipulates that the controller is obligated to inform the data subject, among other things, about the purpose and duration of their data processing. Article 14, on the other hand, concerns the provision of information about the processing of data obtained other than directly from the data subject. However, it should be noted that the provisions regarding personal data processing apply only to natural persons. They do not apply to legal persons, i.e., businesses. Therefore, the Personal Data Protection Office (UODO) has determined that employees, representatives, and persons representing companies are not considered legal persons, but natural persons. Their data will therefore constitute personal data, not data relating to legal persons. The European Commission's position on email addresses influenced the UODO's position. The regulation will then cover data from email addresses if it is an employee's address, e.g., jankowalskistudioKP@gamil, and not the address of a legal person, e.g., studioKP@gmail. Furthermore, the Office took into account the judgment of the Court of Justice of the European Union of 9 March 2017 in Case C-398/15, in which the Court of Justice found that information entered as part of business activity may also constitute personal data. Therefore, this concept should be associated with a natural person, regardless of whether they are a consumer or a business. Therefore, companies that have signed a contract must comply with the obligation to inform the other company's entities about the processing of the personal data of the individuals named therein. The form in which the information is provided is irrelevant; it can be sent by letter or email.
Businesses and lawyers disagree with the UODO's position. They believe the changes will increase workload and formalities for companies, as well as significantly increase costs. They argue that employees and management board members should not be "lumped together." In their opinion, relying on statements from the European Commission and the Court of Justice is erroneous, as the MEPs' statements concerned different issues.
Whether the introduced changes will prove to be effective in protecting entrepreneurs' personal data or will they merely constitute unnecessary and excessive formality will become clear in the near future.
