Regulations on the personal data of witnesses to workplace accidents require amendment

The President of the Personal Data Protection Office, Mirosław Wróblewski, has submitted a request to the Minister of Family, Labour and Social Policy, Agnieszka Dziemianowicz‑Bąk, to initiate work on regulations governing the participation of a witness in proceedings aimed at determining the circumstances and causes of a workplace accident. He also declared expert support in drafting provisions that would establish a legal basis for collecting a witness’s personal data and define the necessary scope of such data.

The provisions of the 2009 Regulation set out, among other things, the actions to be taken by the post‑accident investigation team in order to determine the causes and circumstances of a workplace accident. These provisions regulate, for example, the inclusion in the accident report of the injured person’s explanations and information obtained from witnesses.

However, the 2019 Regulation - which sets out the template for such a report - does not specify which personal data must be collected from witnesses, including whether this should cover their place of residence, despite the Regulation’s explanatory memorandum declaring adherence to the principle of data minimisation. The absence of a clear legal basis defining the scope of data collected from a witness to a workplace accident has resulted in inconsistent practices, which is incompatible with personal data protection standards.

Meanwhile, the supervisory authority has received indications that personal data of witnesses included in accident reports - for example, information about their place of residence - is being shared with numerous entities involved in the post‑accident procedure. This raises legitimate concerns from a privacy‑protection perspective. In some cases, a witness’s place of residence is provided on the basis of their consent, intended to supplement general legal provisions.

The President of the Personal Data Protection Office emphasised that processing personal data on the basis of a witness’s consent may lead to practical difficulties, given that such consent may be withdrawn at any time. The supervisory authority also questions whether such consent can truly be considered voluntary. Moreover, the practice of obtaining consent from a witness is not grounded in universally binding legal provisions. For this reason, it cannot be regarded as compliant with the principles of personal data processing under the GDPR - namely lawfulness, fairness and transparency, purpose limitation, and data minimisation.

The National Labour Inspectorate has informed the President of the Office that it too has identified interpretative issues, as it has encountered questions raised by employees during its activities. According to the Inspectorate, the proper conduct of post‑accident proceedings requires only the use of basic identifying data concerning the witness, already held by their employer (such as name and surname, job position, and organisational assignment).