The Information Obligation: An Important Change in UODO's Position

Dear Sir or Madam,

We are writing to you in connection with the latest position of the President of the Personal Data Protection Office (UODO) of 30 June 2020 on the information obligation, the so-called GDPR clause (link to the announcement: https://uodo.gov.pl/pl/225/1577), which refers to the content of Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR).

The President of UODO took a position contrary to recital 14 of the GDPR and held that the information obligation must be fulfilled towards management board members and proxies (whose data are, after all, public and disclosed in the National Court Register, KRS).

In other words, a clause that until now had to be included with respect to natural persons should also appear, for example, in contracts concluded with entrepreneurs.

The Information Obligation: What Does the GDPR Say?

Recital 14 of the GDPR does indeed state that:

The protection afforded by this Regulation should apply to natural persons, whatever their nationality or place of residence, in relation to the processing of their personal data. This Regulation does not cover the processing of personal data which concerns legal persons and in particular undertakings established as legal persons, including the name and the form of the legal person and the contact details of the legal person.

How to Comply with the Interpretation of the President of UODO

However, in view of the interpretation adopted by the President of UODO, as a precaution (given the possible sanctions that the President of UODO may apply), we recommend, until the President of UODO possibly changes or clarifies this position, taking the following steps when concluding contracts with entrepreneurs:

1. attaching to each contract an annex in the form of a "GDPR Information Clause"

or

2. adding an additional section to the contract containing the entire GDPR clause

in order to fulfil the information obligation towards the persons signing the contract,

3. where the contract names contact persons with their email addresses: sending the information clause to that person's email address on the day the contract is signed,
4. where there is later contact with an employee or representative of the other party: sending the information clause as an attachment at the first contact

or

5. adding a link in the email footer leading to the information clause placed on the website

or

6. adding the information clause to the email footer.