Article 5 PDPA
Restriction of the right of access to information on the processing of data by the controller

1. An administrator performing a public task shall not transmit the information referred to in Article 15(1)-(3) of Regulation 2016/679, if it serves the performance of a public task and the non-performance of the obligations referred to in Article 15(1)-(3) of Regulation 2016/679 is necessary for the performance of the purposes referred to in Article 23(1) of the Regulation, and the performance of such obligations:

1) will prevent or significantly impede the proper performance of a public task, and the interest or fundamental rights or freedoms of the data subject are not overridden by the interest resulting from the performance of that public task, or

2) will violate the protection of classified information.

2. Where the performance of the obligations referred to in Article 15 (1) and (3) of Regulation 2016/679 requires a disproportionate effort to search for personal data, the controller performing the public task shall call on the data subject to provide information allowing the data to be searched. The provision of Article 64 of the Law of June 14, 1960. - Administrative Procedure Code (Journal of Laws of 2017, item 1257, and of 2018, item 149 and 650) shall apply accordingly.

3. In the cases referred to in paragraphs 1 and 2, the controller shall provide appropriate measures to protect the interest or fundamental rights and freedoms of the data subject.

4. The controller shall be obliged to inform the data subject, upon request, without undue delay, but no later than one month from the date of receipt of the request, of the grounds for failure to comply with the obligations referred to in Article 15(1)-(3) of Regulation 2016/679.

1. A controller who has received personal data from an entity performing a public task shall not perform the obligations referred to in Article 15(1)-(3) of Regulation 2016/679 where the entity providing the personal data has made a request in this regard due to the necessity for the proper performance of a public task aimed at:

1) prevention of crime, detection or prosecution of criminal acts or enforcement of penalties, including protection against and prevention of threats to public safety;

2) protection of the economic and financial interests of the state including, in particular:

(a) the realisation and recovery of income from taxes, levies, non-taxable budgetary and other liabilities;

(b) carrying out the administrative enforcement of monetary and non-monetary liabilities and securing monetary and non-monetary liabilities;

(c) preventing the exploitation of the activities of banks and financial institutions for purposes related to treasury fraud,

(d) the disclosure and recovery of property at risk of loss in connection with criminal offences;

(e) carrying out controls, including customs controls.

2. In the case referred to in paragraph 1, the controller shall respond to the request made pursuant to Article 15 of Regulation 2016/679 in a manner that makes it impossible to determine that the controller is processing personal data received from the entity performing a public task