1. PSI Re-use and personal data protection –
Polish experience
Xawery Konarski
Warsaw 22nd of February 2013

2. PSI re-use regulation in Poland
 PSI directive has been implemented in an Act on Access to Public
Information
 provisions on PSI re-use entered into force as of 29th of December, 2011
 Polish Acess&Re-use Act provides for two re-user friendly instuments:
 an obligation of public bodies to make public information avaiable for
re-use
 in principle obtaining of data for re-use purpose is free of charge, as an
exception reimbursement of marginal costs only may be imposed

3. PSI re-use regulation in Poland and personal data
protection
 observation:
 in most cases of re-use an element of processing of personal data
occur
 Access&Re-use Act explicitly says that it does not alter the obligations
and rights set out in Personal Data Protection Act
 conclusion: re-user must observe all provisions of personal data Act while
re-using personal data

4. PSI re-use and personal data – legal controversies (1)
 compliance with a purpose limitation principle
 compliance with a data subject right to be informed in case that
data have been disclosed to another controller

5. PSI re-use and personal data – legal controversies (2)
 observation: in most cases purpose for which re-user processes personal
data is not compatible with a purpose for which data have been collected
by public bodies
 question: is a change of purpose of processing of personal data for re-use
purpose legal without applying for a data subject consent?
 conclusion: PSI Access&Re-use Act constitutes a legal basis for processing
personal data for a new (re-use) purpose

6. PSI re-use and personal data – legal controversies (3)
 data subject should be informed in case that his/her data are being
processed for re-use purpose by a new controller
 observation:
 burdensome and costy obligation (very difficult to be fullfilled by SME)
 on the other hand this obligation enables data subject to object to
process data by a new controller for re-use purpose
• question: do obligation of provision of information always apply in case of
PSI re-use?

7. PSI re-use and personal data – legal controversies (4)
 exemption from an obligation of information in EU laws:
 art.11.2 od Directive 95/46/EC: „Art.11 Paragraph 1 shall not apply
where,………, the provision of such information…….would involve a
disproportionate effort………….. In these cases Member States shall
provide appropriate safeguards.”
 art.14.5 of draft of General Regulation Data Protection Regulation:
„Paragraphs 1 to 4 shall not apply, where provision of such would
involve a disproportionate effort;” In such a case the controller shall
provide appropriate measures to protect the data subject's legitimate
interests (art.14.6)

8. Thank you for your attention.
attn. Xawery Konarski
xawery.konarski@traple.pl