PSI Re-use and personal data protection – Polish experience Xawery Konarski Warsaw 22nd of February 2013
PSI re-use regulation in Poland PSI directive has been implemented in an Act on Access to Public Information provisions on PSI re-use entered into force as of 29th of December, 2011 Polish Acess&Re-use Act provides for two re-user friendly instuments: an obligation of public bodies to make public information avaiable for re-use in principle obtaining of data for re-use purpose is free of charge, as an exception reimbursement of marginal costs only may be imposed
PSI re-use regulation in Poland and personal data protection observation: in most cases of re-use an element of processing of personal data occur Access&Re-use Act explicitly says that it does not alter the obligations and rights set out in Personal Data Protection Act conclusion: re-user must observe all provisions of personal data Act while re-using personal data
PSI re-use and personal data – legal controversies (1) compliance with a purpose limitation principle compliance with a data subject right to be informed in case that data have been disclosed to another controller
PSI re-use and personal data – legal controversies (2) observation: in most cases purpose for which re-user processes personal data is not compatible with a purpose for which data have been collected by public bodies question: is a change of purpose of processing of personal data for re-use purpose legal without applying for a data subject consent? conclusion: PSI Access&Re-use Act constitutes a legal basis for processing personal data for a new (re-use) purpose
PSI re-use and personal data – legal controversies (3) data subject should be informed in case that his/her data are being processed for re-use purpose by a new controller observation: burdensome and costy obligation (very difficult to be fullfilled by SME) on the other hand this obligation enables data subject to object to process data by a new controller for re-use purpose• question: do obligation of provision of information always apply in case of PSI re-use?
PSI re-use and personal data – legal controversies (4) exemption from an obligation of information in EU laws: art.11.2 od Directive 95/46/EC: „Art.11 Paragraph 1 shall not apply where,………, the provision of such information…….would involve a disproportionate effort………….. In these cases Member States shall provide appropriate safeguards.” art.14.5 of draft of General Regulation Data Protection Regulation: „Paragraphs 1 to 4 shall not apply, where provision of such would involve a disproportionate effort;” In such a case the controller shall provide appropriate measures to protect the data subjects legitimate interests (art.14.6)
Thank you for your attention.attn. Xawery Konarskixawery.firstname.lastname@example.org