The President of the Personal Data Protection Office submits comments on the draft review of the Family Foundation Act

Plans to introduce a model providing for widespread access to and the publication online of information about individuals associated with a given family foundation should be subject to particularly thorough consideration by the drafters. In view of this, Mirosław Wróblewski, President of the Personal Data Protection Office, submitted comments on the draft amendment to the Act of 26 January 2023 on family foundations.

The obligation to review the operation of the provisions was introduced by the Family Foundation Act itself, in Article 143. Meanwhile, the draft review of the provisions of the Family Foundation Act – together with the proposed amendments concerning, amongst other things, tax issues – has been submitted to the President of the Personal Data Protection Office for his opinion.

Mirosław Wróblewski, President of the Personal Data Protection Office, pointed out that two changes proposed in the draft review of the regulations are a cause for concern for the supervisory authority.

The first of these concerns the inclusion of the register of family foundations in the National Court Register and the publication online of personal data taken from that register. Meanwhile, work is currently underway at the Ministry of Justice on amending the Act in this direction, as indicated by a document submitted for consultation.

The second proposed amendment concerns granting the National Revenue Administration permanent access to the register and full registration records. This would enable “the full potential of the National Revenue Administration’s analytical capabilities to be utilised and fraud involving the use of family foundation structures to be effectively combated”.

The President of the Personal Data Protection Office did not question the need itself to change the operating model of entities such as family foundations. He did, however, point out that they are not established solely for the purpose of accumulating assets by natural persons. Their function is much broader, and information relating to participation in the foundation’s structures is linked to family and personal relationships. Such information may reveal details about a person within the structure of such an entity, and may:

•                constitute information that is sensitive in terms of privacy and may also include special categories of data protected under Article 9 of the GDPR (e.g. the data of a beneficiary receiving benefits from a family foundation supporting people with cancer, or the data of a founder supporting, through a family foundation, an organisation of an ideological, political or religious nature),

•                the very functioning of family foundations also involves the processing of national identification numbers (PESEL), which are subject to enhanced legal protection,

•                furthermore, the records of family foundations may also contain data covered by legally protected secrets (e.g. documents relating to the medical treatment of a beneficiary of a family foundation, submitted to the records kept in connection with the receipt of benefits).

Adopting this model of operation for family foundations may lead to a range of information about individuals being disclosed online, the vast majority of whom do not hold public office.

The measures that appear to be proposed in the draft amendment to the Act could lead to the widespread availability and disclosure of information concerning family life and income, as well as to the disclosure of specific categories of personal data and the national identification numbers (PESEL) of family members and the beneficiaries of family foundations themselves.

In the opinion of the President of the Personal Data Protection Office – from the perspective of data protection law and the right to privacy – granting the National Revenue Administration permanent access to the register and full registration files containing the data of individuals against whom no criminal proceedings are pending should be regarded as controversial. Such a course of change – irrespective of any potential conflict with the rights guaranteed by the relevant provisions of the Constitution of the Republic of Poland and the GDPR – may be at odds with the case law of international courts, and in particular with case law which emphasises the need to uphold the principle of the presumption of innocence even in proceedings conducted by tax authorities. This was, for example, confirmed by the European Court of Human Rights in its judgment of 23 October 2014 in the case of Melo Tadeu v. Portugal (application no. 27785/10). The case law of the Court of Justice of the European Union has also highlighted restrictions on the collection of data by state authorities – including law enforcement agencies – as noted, for example, in the judgment of 2 March 2021 in Case C-746/18, concerning the collection of telecommunications data by investigative authorities.

The President of the Personal Data Protection Office, in assessing  the proposal to grant the National Revenue Administration permanent access to the register and the full registration files of family foundations,  also reiterated his call for a comprehensive review of the provisions of the National Revenue Administration Act, specifically with regard to regulations concerning the processing of personal data. The supervisory authority had already set out its position on this matter in a statement back in 2024.

At the same time, the President of the Personal Data Protection Office emphasised that, even if the drafters consider the current model of limited disclosure of information about participants in family foundations to be flawed, there are less intrusive and more appropriate methods of regulating access to this data by public authorities and persons with a legitimate interest than the proposal set out in the draft to publish such data online.

The need to develop appropriate solutions is consistent with the direction set out in the case-law of the Court of Justice of the European Union. Of particular relevance in this context is the judgment of 22 November 2022 in the Luxembourg Business Registers case (C-37/20 and C-601/20), concerning registers of beneficial owners maintained by Member States, including Poland. In that judgment, the CJEU stated that it must be examined whether:

•                public access to information on beneficial owners is appropriate for achieving the intended objective in the general interest,

•                the interference with the rights guaranteed by the Charter of Fundamental Rights of the European Union resulting from such access is limited to what is strictly necessary,

•                whether that interference is proportionate to that objective.

Concerns regarding the publication of information on earnings on the internet were also considered by the CJEU in its judgment of 9 November 2010 in the case of Volker and Markus Schecke and Eifert (C-92/09 and C-93/09). The CJEU’s judgment concerned the publication of personal data relating to beneficiaries of funds from the European Agricultural Guarantee Fund. The Court emphasised at the time that: “The publication on a website of personal data relating to the beneficiaries concerned and the exact amounts they have received constitutes, in so far as that data becomes accessible to third parties, an interference with their private life within the meaning of Article 7 of the Charter of Fundamental Rights of the European Union.”

In the conclusion to his statement, the President of the Personal Data Protection Office pointed out that the drafter, when deciding on a change to the model for processing personal data in family foundations, should ensure compliance with personal data protection legislation and include, in the provisions introducing such a model, appropriate and specific measures to safeguard the rights and freedoms of data subjects.

DPNT.401.265.2026