Law note · Poland
GDPR Article 9, Act Article 107(2), and Kodeks Pracy Article 22(1b), Biometric Data
General Data Protection Regulation (GDPR) Article 9(1) lists biometric data processed for unique identification as a special category.
Poland's own Act Article 107(2), read directly, independently names biometric data processed for unambiguous identification as one of the aggravating categories that raises the criminal penalty ceiling for unlawful processing from two to three years' deprivation of liberty, alongside racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, health data, and sexual life or orientation data.
Article 107(2)'s own in-force date is the Act's general commencement date, 25 May 2018, confirmed by the same direct read of Article 176 already used for this document's comprehensive_regime instrument.
For employees specifically, Kodeks pracy Article 22(1b), read verbatim, permits biometric-data processing on consent only where the employee supplied it on their own initiative, plus a narrow no-consent carve-out for controlling access to particularly sensitive information or specially protected premises; only staff holding written authorization may process it, bound to confidentiality.
This session confirmed the current Kodeks pracy text but not the amending act or the precise date that provision was inserted, so no date is asserted for the Kodeks pracy limb specifically, only for the Act Article 107(2) limb this instrument's effective_date reflects.
What it asks of an app
- Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric data of a person in Poland; unlawful processing of biometric data carries a raised criminal penalty ceiling under Act Article 107(2).
- Limit an employer's no-consent biometric processing of a Polish employee to controlling access to particularly sensitive information or specially protected premises, and restrict access to authorized, confidentiality-bound staff, per Kodeks pracy Article 22(1b).
When LexLint raises it
Declared activities: processes_biometrics, processes_voice
Primary source: Ustawa z 10 maja 2018 r., Art. 107(2) and Art. 176 (direct read, in-force date)
Kodeks pracy, Art. 22(1a)-22(1b) (direct read, no insertion date confirmed)