The new provisions of the Regulation will replace
both the directive governing the protection of
individuals with regard to the processing of
personal data and the free movement of such data
and the currently effective Polish Act on Personal
Data Protection. The Regulation’s entry into force
causes a number of changes that will mainly affect
enterprises processing personal data of natural
persons, offering goods or services in the European
Union.
One of the most significant novelties of the
Regulation is the expanded definition of “personal
data”. The purpose of the expansion was to realign
the concept of personal data with business
practice, and in particular with online data
processing. The term personal data has been
defined under the Regulation by way of non-
exhaustive listing of the types of information
relating to an identified or identifiable nature
person.
Pursuant to Article 4(1) of the Regulation,
“personal data” means any information relating to
an identified or identifiable natural person (‘data
subject’). The Regulation provides that an
identifiable natural person is one who can be
identified, directly or indirectly, in particular by
reference to an identifier such as a name, an
identification number, location data, an online
identifier or to one or more factors specific to the
physical, physiological, genetic, mental, economic,
cultural or social identity of that natural person.
The data categories referred to in the above
provision are provided merely as examples, as
indicated by the expression “in particular”. As
types of data, the Regulation itself lists for example
online identifiers, i.e. IP addresses, cookie
identifiers or other identifiers such as for instance
radio frequency identification tags, as such
identifiers when combined with another unique
identifier may be used to create profiles of natural
persons and identify them.
The Regulation distinguishes certain types of
personal data as “special categories of personal data” whose processing is in principle prohibited.
Pursuant to Article 9.1 of the Regulation special
categories of personal data include: data revealing
racial or ethnic origin, political opinions, religious
or
philosophical
beliefs,
or
trade
union
membership, and data concerning a natural person’s
sex life or sexual orientation, genetic data,
biometric data, data concerning health. Provisions
of the Regulation, by way of elaborating on the last
three categories, stipulate for example that genetic
data relates to the inherited or acquired genetic
characteristics of a natural person which give
unique information about the physiology or the
health of that natural person. Biometric data means
data relating to the physical, physiological or
behavioural characteristics of a natural person,
which allow or confirm the unique identification of
that natural person, such as facial images or
dactyloscopic data. In turn, data concerning health
means all data pertaining to the health status of a
data subject which reveal information relating to
the past, current or future physical or mental
health status of the data subject, examination
results, identification numbers, medical histories,
any information on disability or information on
treatment of any diseases.
In conclusion, the Regulation considerably extended
the meaning of the term personal data by realigning
it with the requirements of e-commerce and the
related
methods
of
identification
of
its
participants, such as: IP address, geolocation, or
biometric data.
MILLER, CANFIELD,
W. BABICKI, A. CHEŁCHOWSKI I WSPÓLNICY SP.K.
ul. Batorego 28-32
81-366 Gdynia
Tel. +48 58 782-0050
Fax +48 58 782-0060
gdynia@pl.millercanfield.com
ul. Nowogrodzka 11
00-513 Warszawa
Tel. +48 22 447-4300
Fax +48 22 447-4301
warszawa@pl.millercanfield.com
ul. Skarbowców 23a
53-125 Wrocław
Tel. +48 71 780-3100
Fax +48 71 780-3101
wroclaw@pl.millercanfield.com
Disclaimer: This publication has been prepared for clients and professional associates of Miller Canfield. It is intended to provide only a summary of
certain recent legal developments of selected areas of law. For this reason the information contained in this publication should not form the basis of any
decision as to a particular course of action; nor should it be relied on as legal advice or regarded as a substitute for detailed advice in individual cases.
The services of a competent professional adviser should be obtained in each instance so that the applicability of the relevant legislation or other legal
development to the particular facts can be verified.