It is evident, as confirmed by representatives of the Ministry of Digital Affairs, that each of the parties interested in the implementation of the new regulations, namely both the Polish DPA and organizations dealing with the protection of citizens' rights, advocates for changes that are most significant from the perspective of the interests they represent, and developing a position acceptable to all interested parties is, understandably, exceedingly difficult.
Requests of Entrepreneurs and Indications from the Ministry of Digital Affairs Regarding Them
As mentioned above, entrepreneurs have presented many proposals for changes, with some of them being prioritized over others. Initially, it was raised that the submitted draft, when assessed as a whole, does not take into account the message emerging from Recital 4 of the Regulation, which states that the right to the protection of personal data is not an absolute right and must be balanced against other fundamental rights in accordance with the principle of proportionality. This objection was also derived, among other things, from an analysis of the Introduction to the draft provisions of the Personal Data Protection Act. This argument, although presented as an introduction to the discussion, was in fact a summary of other reservations contained in the position presented by entrepreneurs, particularly concerning the introduced rigor of immediate enforceability, the lack of appeal remedies regarding decisions made during the proceedings, or the exclusion of the possibility of reaching a settlement, as well as the exclusion of provisions regarding notification of the intention to initiate an inspection. All the issues presented, including those mentioned above, contribute to the creation, according to entrepreneurs, of an office that will have disproportionately broad powers in relation to the rights that will be granted to the parties. Thus, the aspect of balancing against other rights, including fundamental rights, has been lost, and the protection of personal data has been granted the status of the highest right among these fundamental rights, forgetting and depriving of significance the principles related to the freedom to conduct business or the right to good administration (everyone has the right to be heard before individual measures that may negatively affect their situation are taken).
GDPR.
Support is Useful
Administrative route appropriate for matters related to personal data protection
When discussing in detail only the most important points, it is necessary to start with the one presented first. Namely, this concerns the administrative route chosen in the project as appropriate for matters related to personal data protection. It has been suggested to reconsider the justification for such a solution, indicating the District Court in Warsaw – Court of Competition and Consumer Protection as competent. “There are many arguments in favor of this concept. The first and most important is the essence of the matter and the nature of the legal relationships subject to the control of the President of the Polish Data Protection Authority, and subsequently to judicial review. There is no doubt that personal data is processed both within public administration (in connection with the performance of public tasks) and in the “private” sector, within property relationships and the activities of entrepreneurs and consumers, in connection with the conclusion and performance of contracts.” Representatives of the Ministry on this matter have taken a firm and, as it should be assumed, justified position that these matters belong and will continue to belong to the administrative branch of law, and administrative courts already have many years of experience in cases in this area. Additionally, the representatives of the Ministry argued in favor of administrative jurisdiction by pointing out that proceedings before these courts are conducted more quickly than before common courts. It is hard to disagree with the representatives of the Ministry regarding the experience of administrative courts in matters related to personal data protection. As for the speed of proceedings, it can be debated.
Exclusion of the possibility of reaching a settlement
One of the second most important reservations is the exclusion of the possibility of reaching a settlement. The justification for excluding such a possibility was the fact that under the currently applicable regulations, there is already an opportunity to utilize a settlement, which right is not being utilized at all. Additionally, it was argued that the possibility of reaching a settlement could lead to abuses and attempts to circumvent the law in such a way that entrepreneurs would not fully comply with data protection principles, and in the event of a complaint, they would reach a settlement by paying an appropriate sum to the person whose rights have been violated. During the discussion, in reference to the topic of settlement, the proposal made by the Inspector General for Personal Data Protection (GIODO) was also discussed, namely the introduction of preliminary proceedings, which would proceed in such a way that a complaint submitted to the Polish Data Protection Authority would be forwarded to the entity that committed the potential violation in order to allow the parties to reach an agreement, which would be accepted by the President of the Polish Data Protection Authority. Allowing for the possibility of reaching a settlement is, as one might assume, worth considering. The arguments in favor of excluding this possibility in the draft law are not convincing. It is difficult to justify that in the case of personal data protection, the essence of potential violations of any kind would be of such significance that a settlement could generally be deemed inadmissible. Moreover, the Ministry, which has repeatedly indicated the speed of proceedings as a priority, could achieve its intended goal in such a way that many cases would have the chance to be resolved already at the preliminary stage, which would, of course, be supervised by the President of the Polish Data Protection Authority, preventing settlements in those cases where they would violate the law, the public interest, or the legitimate interest of the party. Not every case concerning personal data protection seems to be significant enough to justify the complete exclusion of settlements.
E-learning GDPR is already a standard!
Immediate enforceability
Another issue raised by entrepreneurs, which is absolutely valid, was the questioning of the introduction of the immediate enforceability clause into the draft law. This solution seems to be entirely unjustified. The written justification for the draft does not dispel doubts either. As an argument for granting immediate enforceability to decisions issued by the President of the Polish Data Protection Authority, the speed of proceedings and the desire to spare the authority from the necessity of separately granting this enforceability to all decisions were cited. This solution is purportedly justified by the nature of the protected good, which is the right to personal data protection. Additionally, during the discussion, it was pointed out that there is a lack of understanding from the Ministry of Digital Affairs regarding the opposition to the immediate enforceability clause, since decisions are already enforceable due to the one-instance nature of the proceedings, and an appeal does not suspend their execution.
At this point, which was not raised by entrepreneurs at the meeting, it is necessary to recall the characteristic features and the purpose that this institution is meant to serve. Immediate enforceability is only granted to decisions against which an appeal is available. The essence of immediate enforceability is to allow for the execution of decisions in exceptional situations, even though, according to general principles, they should not yet be subject to execution, as an appeal is permissible. Moreover, immediate enforceability should only be granted in highly specific situations where the protection of human life or health is at stake, the safeguarding of the national economy from severe losses, or due to another social interest or an exceptionally important interest of a party. Therefore, let us note that the issue being resolved must be of great significance for it to be granted. The grounds justifying its application, precisely due to the uniqueness of this institution, cannot be interpreted broadly. Thus, it cannot be the case that all decisions will be burdened with this by virtue of the law. It is difficult to agree, without dismissing the rationale, that personal data protection is a fundamental right, that all decisions under this clause will certainly require it, as the grounds for its granting will be met. In no case can the assertion presented in defense of its introduction, that if a decision burdened with this clause turns out to be erroneous, civil claims can be pursued against the President of the Authority, be considered a substantive argument.
Working with good GDPR tools is not work!
Even if the introduction of rigor in the discussed case will not carry significant practical consequences due to the fact that there will be no appeal against the decision, and thus it will be enforceable (with the caveat that a request to suspend the execution of the decision can be made in a complaint to the administrative court), it is impossible to agree to leave this institution in place when there are no grounds for its application and it will not fulfill its function. However, setting aside considerations strictly based on legal provisions, it cannot be denied that there is a certain difference between an enforceable decision and an immediately enforceable one.
Lack of Appealability of Decisions within the Proceedings
The last of the issues raised, which will be discussed in this article, is the issue of the lack of appealability of decisions within the proceedings. Representatives of the Ministry of Digital Affairs explain that this measure has been implemented to achieve the goal of quick resolution of cases, and the possibility of appealing decisions will still be preserved, as the review of the validity of the decision would be conducted during the examination of the complaint by the court. This position is supported by the belief that it will not only expedite the proceedings but also prevent situations where the authority issues a decision faster than the court responds to the complaint. The far-reaching optimism of the representatives of the Ministry of Digital Affairs regarding the potential future speed of proceedings completely blocks entrepreneurs' ability to present their arguments. It not only fails to provide the means to appeal decisions but also, as in Article 24 of the draft law, excludes one of the fundamental principles of administrative law, namely the principle of hearing the parties and active participation in the proceedings. If the expectations of the representatives of the Ministry of Digital Affairs regarding the speed of proceedings do not translate into reality, then by applying, for example, the aforementioned Article 24, the President of the Polish Data Protection Authority will be able to completely prevent the conduct of business without the possibility of defense by the entrepreneur, nor even the opportunity to present their arguments due to the exclusion of Article 10 of the Code of Administrative Procedure.
Summary
The meeting, although it is impossible to fully convey its course, was not only interesting but also educational. From all the actions taken, one fundamental conclusion can be drawn: it is worthwhile to engage in dialogue. The Ministry of Digital Affairs, by presenting its reasons and arguments for making such decisions and rejecting other proposals, sheds light on the project and allows for a complete appreciation of all its merits. Proper and thorough communication regarding the status of the project enables interested parties to understand each other's intentions. Nevertheless, this does not change the fact that it is necessary in this case to safeguard the rights and interests of entrepreneurs, which, in the name of expediency, seem to be not fully recognized.
