Poland's Draft Data Protection Law To Alter The Rules For Data Transfer And Data Privacy Officers

A draft of Poland's new draft data protection law has been released and has the potential to significantly change the rules in Poland governing international data transfers and data privacy officers.

Under existing rules, Poland is an EU member state that does not currently recognise the Standard Contractual Clauses or Binding Corporate Rules (BCRs) as sufficient legal basis for international transfers of data to third countries unable to provide an adequate level of data protection. This has meant that, to date, organisations have encountered difficulties and an administrative burden each time they transfer new categories of data for a new purpose. The only way such transfers have previously been permitted is with prior written consent of every data subject (impractical for large organisations) or with the prior consent of the Polish data protection authority GIODO (such approval taking up to six months in some cases).