GDPR policy – personal data protection – Adwokat Przemysław Sławiński

GDPR policy – personal data protection
Personal data processing notice

Pursuant to art. 13(1) and art. 13(2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [hereinafter: GDPR])

§ 1. The administrator of personal data

 The administrator of your personal data is Przemysław Sławiński, attorney (hereinafter: “Administrator” and “Attorney”), running the Law Office at Mikołaja Reja 29, 96-500 Sochaczew, tel. +48 513-465-656, e-mail address: [email protected], www.kancelaria-slawinski.pl.

§ 2. The purpose of the processing 

a) the provision of legal assistance to the Client Under art. 4(1) of Act 26 May 1982 – Law on the Bar (J.L. 1982 No 16, item 124) [hereinafter: “Law on the Bar”] “the attorney’s profession involves the provision of legal service, in particular through the provision of legal assistance, drafting of legal opinions, preparing draft legislation, and appearing before courts and administrative bodies.” The legal definition of the attorney’s profession formulated in such a way sets out the objectives of the processing of personal data within the practice of the attorney’s profession, which is to provide legal service to the Clients.
b) communication with persons representing the Client concerning the provision of legal service to the Client and the performance of the contract with the Client It should be noted that the attorney also has such Clients who are not contacted personally, but through persons representing them. Legal persons (eg. capital companies operating under the commercial law) or the so-called imperfect legal persons (eg. partnerships operating under the commercial law). Such Clients communicate with the attorney mainly through the persons being members of the company’s body (eg. management board members, partners) or through their employees.
c) archiving purposes Art. 16c(1)(2)(c) of the Law on the Bar prescribes the time-bound data processing and storage procedure performed by the attorney within the practice of the attorney’s profession. In other cases, personal data are stored throughout the period until the expiration of the limitation period for claims to which the personal data are related.
d) professional cooperation Apart from the processing of the personal data of the Clients, the attorney may process the data of the persons with whom he cooperates permanently or temporarily within the practice of the profession. Such persons are above all attorneys, trainee attorneys, attorneys-at-law, and trainee attorneys-at-law.
e) conclusion and performance of the contracts not related to the provision of legal assistance Another category of persons whose personal data are processed by the attorney are counterparties whose data are processed by him within the scope of the conclusion and performance of the contracts not related to the provision of legal assistance. Such counterparties may include above all landlords who rent out their premises to the attorney or printing industry service providers.

§ 3. The legal bases of the processing of the so-called basic personal data: 

a) the performance of a contract of which the data subject is a party or taking steps at the request of the data subject prior to entering into a contract or measures undertaken at the request of the data subject prior to the conclusion a contract (art. 6(1)(b) GDPR) On this basis, the personal data of the Clients are processed with reference to the provision of legal assistance or the drafting of legal opinions, and furthermore, the data of the counterparties with reference to the performance of the contracts related to the everyday activities of the attorney’s office.
b) the processing is necessary for compliance with a legal obligation to which the administrator is subject (art. 6(1)(c) GDPR) On this basis, the personal data of the Clients are processed with reference to conducting cases before courts, administrative bodies, prosecutors, because the processing of them flows directly from the mandatory rules of procedures, in particular art. 119 of the Code of Criminal Procedure, art. 126 of the Code of Civil Procedure, art. 63 of the Code of Administrative Procedure, and art. 46 of the Law on the Proceedings before Administrative Courts.
c) the processing is necessary to protect the vital interests of the data subject or of another natural person (Art. 6(1)(d) GDPR) On this basis, the personal data are processed only when the processing evidently can not be based on any other legal basis.

§ 4. The legal bases of the processing of the personal data of special categories: 

a) processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent (art. 9(2)(c) GDPR) The incapability to giving consent by data subject stems from their physical or psychological state or the lack of capacity of legal action. Vital interests shall be understood as human life and health and sometimes such person’s property interests.
b) processing is necessary for the establishment, assertion or defence of legal claims or whenever courts are acting in their judicial capacity (art. 9(2)(f) GDPR) This basis relates to the processing of personal data in connection with the assertion or defence of claims in court, administrative as well as extrajudicial proceedings.

§ 5. The personal data storage period:

10 years from the end of the year of the completion of the procedure for whose purpose the personal data was collected – in the case of personal data processed within the practice of the attorney’s profession (art. 16c(1)(2)(c) of the Law on the Bar), whereas in other cases throughout the period until the expiration of the limitation period for claims to which the personal data are related.

§ 6. The data subject has the right of: 

access to the personal data as long as it does not lead to the breach of attorney-client privilege, rectification or supplementation of personal data; deletion of personal data unless the processing of them is necessary to the establishment, assertion, or defence of legal claims; restriction of the processing of the personal data as long as it does not lead to the breach of attorney-client privilege; objection to the processing of their personal data unless the data have been obtained by the attorney in relation to the provision of legal assistance.
The aforementioned rights of the data subject flow from art. 16a of the Law on the Bar. They are restricted by the attorney’s obligation of professional secrecy referred to in art. 6 of the Law on the Bar, whereas in the case of the possibility of making objection to the processing of their data, this right is subject to restriction with regard to the data obtained by the attorney in relation to the provision of legal assistance. Pursuant to art. 6(1-3) of the Law on the Bar “the attorney is under a duty to keep secret all information they have learnt in the course of providing legal assistance. (1) The duty of professional secrecy can not be limited in time. (2) The attorney may not be relieved from the duty of professional secrecy with regard to facts which came to their knowledge whilst providing legal assistance or whilst conducting a case. (3).” The definition of legal assistance is explained in § 2(a).

§ 7. The right to lodge a complaint:

 in the case of unlawful processing of data, the data subject has the right to lodge a complaint to the supervisory authority – the President of the Personal Data Protection Office.

§ 8. The duty to submit personal data to the Administrator:

 a) the provision of legal assistance by the attorney requires the Client or the person representing the Client to submit personal data, with the exception of legal advice or other one-time activity, which flows from regulations governing the bar and general laws, including tax laws; lack of acceptance from the Client to provide personal data may lead to the attorney’s refusal to provide legal assistance to the Client where specified;
b) the provision of legal assistance consisting in the conduction of the Client’s case in proceedings before courts, administrative bodies, law enforcement authorities is linked to a statutory obligation for the Client to provide personal data which flows from the legal provisions on the proceedings before the aforementioned entities; lack of acceptance from the Client to provide personal data may lead to the attorney’s refusal to provide legal assistance to the Client where specified;
c) professional cooperations between attorneys or attorneys-at-law may trigger the requirement to provide personal data, in particular in situations where a case is conducted jointly or where a substitution in court proceedings is accepted or granted; refusal to provide personal data may result in activities of such kind not being rendered.
d) conclusion and performance of contracts not related to the provision of legal assistance may trigger the requirement of the counterparty to provide personal data if it is required by the provisions of the civil and tax law; refusal to provide personal data by the counterparty may result in the contract not being concluded.

§ 9. Personal data processing automation 

The Administrator does not perform the processing of personal data in an automatised manner, nor does he undertake decisions based on automatised processing of them.