Romanowska - Labour and employment law

A bill entitled the Act on Specific Solutions Facilitating Business Operations During the COVID-19 Epidemic has been filed with the Sejm. It would allow employers in Poland to demand information from employees about COVID-19 test results, having undergone a COVID-19 infection, or vaccination against COVID-19.

According to the proposal, an employer would be entitled to demand information from an employee or a person in a civil-law relationship (e.g. a contractor) to the effect that the person has obtained a negative COVID-19 test within 48 hours before submission of the information.

Work is underway on a bill implementing the EU’s Whistleblower Directive (2019/1937). It is not yet clear whether the directive will be implemented into Polish law on time (by 17 December 2021), but many companies are already drafting the necessary documents and organisational procedures.

Since 16 July 2020, companies transferring personal data from the EU to the US, including employees' personal data, have had a difficult nut to crack. The Court of Justice of the European Union invalidated the decision in the Privacy Shield case, depriving companies of the possibility of basing data transfers to the US on this basis. However, the Court's judgment (so-called Schrems II) may have serious consequences for companies transferring data to other countries outside the European Economic Area as well.

GDPR rules require certain entities to appoint a Data Protection Officer. Where an organisation considers that such an obligation does not apply to it, it should properly document this.

Many employers believe that they have the right to require their employees to provide information on their disability. This is because employers have an obligation to ensure that employees with disabilities can exercise particular privileges. The Personal Data Protection Office ('PDPO') examined this issue in its position paper published on 24 August 2020, where it reminded that it is up to the employee to decide whether or not to provide such information.

In its paper published on 30 June 2020, the Data Protection Authority (“DPA”) expressed the view that the data of management board members representing a legal person are protected by the GDPR as the data of natural persons who are identifiable by using data disclosed in the National Court Register.