Characteristics of employee’s duty to protect personal data

Pursuant to Article 100 § 2 item 5 of the Labour Code dated 26 June 1974 an employee is required to observe confidentiality laid down under separate statutory provisions. This obligation covers a worker who, by virtue of the pursuit of a particular type of work or by virtue of the place where the work is exercised,  has access to information of the kind covered by the obligation of secrecy laid down in separate provisions. One of the cases of confidentiality protected by law under separate provisions is the confidentiality of personal data and the ways of their protection. The obligation of confidentiality by persons authorised to process personal data is based on Article 39(2) of the Data Protection Act of 29 August 1997. The employer, acting as the administrator of personal data, gives an individually appointed employee by name the authorisation to process personal data. In the authorisation the employer shall specify the following: 1/types of personal data to which a given employee shall have access, 2/ means of the processing of personal data to be fulfilled by a given employee. The employee authorised to process personal data shall be bound by the obligation to keep the data and the ways of their protection used by a given employer secret.

Pursuant to Article 100 § 2 item 5 of the Labour Code dated 26 June 1974 an employee is required to observe confidentiality laid down under separate statutory provisions. This obligation covers a worker who, by virtue of the pursuit of a particular type of work or by virtue of the place where the work is exercised,  has access to information of the kind covered by the obligation of secrecy laid down in separate provisions. One of the cases of confidentiality protected by law under separate provisions is the confidentiality of personal data and the ways of their protection. The obligation of confidentiality by persons authorised to process personal data is based on Article 39(2) of the Data Protection Act of 29 August 1997. The employer, acting as the administrator of personal data, gives an individually appointed employee by name the authorisation to process personal data. In the authorisation the employer shall specify the following: 1/types of personal data to which a given employee shall have access, 2/ means of the processing of personal data to be fulfilled by a given employee. The employee authorised to process personal data shall be bound by the obligation to keep the data and the ways of their protection used by a given employer secret.