On April 11, 2024, the Polish data protection authority (UODO) announced that it had provided an opinion on the proposed act on corporate governance in companies with State Treasury shareholding.

In particular, the UODO noted that the draft act proposes extensive disclosure of personal data, including personal identification numbers (PESEL numbers) and remuneration, of individuals managing State Treasury companies. This raised concerns about privacy rights and the need to balance transparency with data protection under the General Data Protection Regulation (GDPR) and constitutional provisions while aiming to ensure professionalism and expertise in the management of public assets.

Furthermore, the UODO encouraged the law drafters to reanalyze the following areas:

• necessity for a privacy test as mandated by Article 35 of the GDPR, which would evaluate the impact of the proposed act on personal data protection; and
• the register should refrain from disclosing PESEL numbers, and access to remuneration data should align with the standards set by the Court of Justice of the European Union (CJEU), ensuring it is made available under specific conditions.

Finally, the UODO urged a thorough privacy assessment, cautious disclosure of personal data, and a holistic approach to other draft laws pertaining to transparency in public functions, aiming for a balance between accountability and privacy rights.

You can read the press release here and download the opinion here, both only available in Polish.