What status do Employee Loan and Relief Funds (PKZP) have? Should a joint controllership agreement be concluded?

ANSWER

An Employee Loan and Relief Fund will be a data controller independent of the employer. A personal data processing agreement should not be concluded between the Fund (controller) and the employer/workplace, as a processor has a completely different status in such a relationship. Both the employer (workplace) and the PKZP, in respect of the personal data they process, independently determine their own purposes and means of processing, and should therefore be treated as separate controllers.

However, § 4 of the PKZP regulation (Council of Ministers Regulation of 19 December 1992 on employee loan and relief funds and cooperative savings and credit funds in workplaces) provides for assistance from the employer (workplace) in performing PKZP tasks (including keeping accounts, cash and legal services, making deductions on payroll on behalf of the PKZP, monthly contributions and loan instalments, etc.), and the detailed terms of the assistance provided are to be set out in an agreement concluded between the employer and the PKZP. Within such legally structured relations, it may be considered that these entities cooperate with each other and therefore jointly determine the purposes and means of processing personal data used for that purpose — they therefore process them as joint controllers.

The same position was expressed by the Personal Data Protection Office on 28 July 2020, which can be consulted at the following link: https://uodo.gov.pl/pl/225/1619.