If the Labour Office refers unemployed persons for an internship at a given company, what GDPR obligations must the company fulfil?

ANSWER

The situation addressed by the question is similar to that described in the Polish DPA position in which a university referred a student for an internship: https://archiwum.uodo.gov.pl/pl/225/1454.

According to the Polish DPA position, the entity accepting an intern carries out its own tasks within the scope of the agreement concluded, arising from the provisions of the agreement and from specific legislation, e.g. occupational health and safety rules contained in the Labour Code, as well as from internal regulations such as records of entries and exits, records of internship time, and granting authorisations to process personal data. For this reason, the entity accepting an intern should be regarded as an independent data controller of the personal data of the person accepted for the internship.

In connection with the above, fulfilment of all obligations of the data controller set out in the GDPR is necessary, and thus above all fulfilment of information obligations towards the person accepted for the internship.

If the person accepted for an internship will have access to personal data, it will be necessary to grant that person an appropriate authorisation to process data.

It should be borne in mind that the fact that the internship is funded from EU funds should not affect the regulation of the situation described, since the employer will still accept the intern and will carry out its own tasks on the basis of external laws and regulations. It will therefore not be necessary to conclude a data processing agreement.