Following the CJEU judgment, provisions on the National Police Information System should be amended

The CJEU judgment C- 118/22 entails the need to consider amending the Police Act of 6 April 1990 with regard to the provisions regulating the operation of the National Police Information System.

This opinion was provided by Miroslaw Wróblewski, President of the Personal Data Protection Office, in response to a question from the Minister for European Union, Adam Szłapka.

On 30 January 2024, in Case C- 118/22 concerning the processing of personal data in connection with the prevention and combating of crime, the CJEU held that the GDPR , in conjunction with the Charter of Fundamental Rights of the European Union, precludes national legislation providing for the storage by police authorities of biometric data, concerning persons who have been convicted by final judgment of an intentional criminal offence subject until the death of the data subject.

Such data are  used by police services for crime prevention, pre-trial investigations, detection and prosecution of offences and enforcement of penalties. The CJEU ruled that controllers of such data should review periodically whether that storage is still necessary. Data subject must be given right to have those data erased, where their storage is no longer necessary.

In the  Polish law, the processing of conviction data by the Police authorities takes place on the basis of the provisions of the Act on the National Criminal Register, the Act on the Processing of Criminal Information and the Act on the Police, which regulates the functioning of the National Police Information System (KSIP). The latter Act should be amended because the provisions concerning the KSIP do not oblige the Commander-in-Chief of the Police to carry out a periodic review of the data contained in the KSIP with regard to the need for further processing. Nor do they grant the data subject the right to erasure of such data. The lack of adoption of transparent procedures for the deletion of data from the KSIP and the prerequisites determining their suitability for further processing contradict the view expressed by the CJEU in this judgment.

The opinion of the President of the Personal Data Protection Office on the CJEU judgment C- 118/22 is available in the file attached below (in Polish).

DOL.0623.10.2022