The Minister of Digital Affairs has issued regulations for the application, which specify, among other things, the rules for processing personal data collected in connection with its use, for which the administrator is the minister. It should be noted that in order to use the software, it is necessary not only to provide one's first and last name and phone number, but also to periodically take a "selfie" and share GPS location data, while information about quarantine violations will be automatically transmitted to the authorities. Additionally, in the event of symptoms of infection, the user must immediately notify the authorities using the available functionalities. The user account is generally active for 14 days, after which the data is stored by the minister for the period of limitation of claims specified in Article 118 of the Civil Code (6 years).
Receive a package of free GDPR guides and micro-trainings
Data may also be transmitted to other services and institutions that the Act on Preventing and Combating Infections and Infectious Diseases in Humans grants powers in connection with monitoring the implementation of quarantine for individuals and epidemic supervision.
The Minister indicates that the legal basis for processing is Article 9(2)(i) of the GDPR, i.e., the processing is necessary for reasons related to the public interest in the field of public health, such as protection against serious cross-border health threats. However, the user of the application retains the rights arising from the GDPR, namely the right to access data, to rectify it, to object, to restrict processing, and of course to lodge a complaint with the President of the Polish DPA.
It should be noted that according to the GDPR, in certain situations, the ability to exercise rights is limited.
