Register maintained by the GIODO, by the ABI, and the list of personal data sets.
To properly understand the essence of the register maintained by the ABI (download the sample register), it is essential to distinguish it from the two other registers of data sets that are maintained concurrently. Firstly, according to the regulation of April 29, 2004, on the documentation of personal data processing […], every data controller must prepare and implement documentation for personal data protection. One of the elements of the required documentation, in accordance with § 4 point 2 of the aforementioned regulation, is a list of personal data sets along with an indication of the programs used for processing this data. This list is a component of the personal data protection documentation, describing all personal data sets for which our entity is the data controller. This applies to both data that must be disclosed in the GIODO or ABI register and those that are exempt from this obligation.
On the other hand, there is the register maintained by the GIODO based on Article 12 point 4 of the Personal Data Protection Act. The GIODO maintains a register of data sets and provides information about the registered data sets. This is another register of data sets, which is not as comprehensive as the aforementioned list of data sets, as there is a wide catalog of exemptions from the obligation to register data sets in the register maintained by the GIODO (Article 43 of the Personal Data Protection Act). Additionally, it is worth mentioning a new exemption from the registration obligation that has appeared in point 12 of the aforementioned article:
Article 43.
1. Data controllers are exempt from the obligation to register a data set:
[…]
12) processed in sets that are not maintained using IT systems, except for sets containing data referred to in Article 27 paragraph 1
By virtue of the above exemption, data sets of so-called ordinary data, maintained only outside of an IT system, are not subject to the registration obligation in the register maintained by the GIODO.
The third register that emerged with the entry into force of the amended provisions of the Personal Data Protection Act (Article 36a paragraph 2) is the register maintained by the ABI. This register, like the GIODO register, is public (anyone can review it) and contains information analogous to that found in the register maintained by the GIODO.
Why another register of data sets?
In connection with the exemption from the obligation to register in the register maintained by the GIODO (pursuant to Article 43(1a) of the Personal Data Protection Act) of collections of ordinary personal data, an element of lack of transparency regarding information about the collections maintained by those data controllers who appointed and reported a Data Protection Inspector (ABI) to the GIODO register has emerged. To eliminate this deficiency, the legislator imposed the obligation to maintain a register on the ABI itself. In principle, this is the only reason for maintaining this register. Additionally, the legislator introduced a number of possibilities for the ABI to make the register available.
Three forms of making the register maintained by the ABI available
Firstly, the register may be made available on the data controller's website, with a reference placed on the homepage allowing direct access to the register. Secondly, the register may be made available at the data controller's premises at an access point (e.g., at a computer) – it will be displayed on a screen monitor. Thirdly, the register may be printed from the IT system and made available in paper form to any interested person or, in the case of maintaining the register only in paper form (without the use of an IT system), by allowing the register to be viewed. It is worth adding that when making the register available on the website, it is not necessary to include information about so-called data processors, i.e., external entities that process personal data on our behalf. However, in such a case, access to this information must be guaranteed at the data controller's premises.
Which collections are included in the register maintained by the ABI?
The register maintained by the ABI includes only those collections of personal data that have not been exempted from the obligation to register in the register maintained by the GIODO (exemptions under Article 43(1)). Therefore, the register maintained by the ABI does not include, for example, the collection of personal data of employees, as this collection is exempt from the obligation to register in the register maintained by the GIODO.
In the register of collections maintained by the ABI, there are actually only collections of personal data that would be subject to registration if the data controller had not appointed and reported its ABI to the GIODO register.
Summary
The maintenance of an additional register is the obligation of the ABI, so the legislator cannot be accused of imposing an additional obligation on the data controller. On the other hand, it will become increasingly difficult to prove to the data controller that their ABI, who is most often concurrently an employee, possesses the organizational independence necessary for the proper performance of the tasks defined in Article 36a(8) of the Personal Data Protection Act.
Download the template of the records of processing activities
