Polish data protection authority seeks personal data rules for civic budgets

The President of Poland’s Personal Data Protection Office, Mirosław Wróblewski, has called for legislation clarifying how personal data should be processed in so-called civic budget procedures.

In a submission to the Minister of the Interior and Administration, Wróblewski said that current local government rules do not comprehensively regulate the processing of personal data in participatory budgeting.

According to the office, civic budget procedures involve the processing of personal data not only by public authorities but also by citizens who collect, record, and submit support lists for proposed projects. The authority says this has created practical difficulties for both public bodies responsible for consultations and the people whose data are processed.

The office says local government laws in Poland should clarify who acts as the data controller, what categories of personal data may be processed, how the status of eligible voters should be verified, and how personal data should be secured. It notes that current rules leave these issues largely to local resolutions, without precise statutory criteria on data processing.

The submission also raises concerns about the scope of personal data collected during voting. It states that some civic budget procedures require voters to provide a PESEL number, which can exclude residents who do not have one, including some foreigners and Polish citizens born abroad who use only a passport.

The office says the collection and further processing of PESEL numbers for strictly defined purposes should follow directly from legal provisions and notes that administrative case law has generally found no legal basis for requiring it in this context.

The authority also calls for rules on electronic voting in civic budgets. It says that local authorities do not always consider themselves responsible for data security before support lists are transferred, and that people collecting signatures are not always aware of their responsibilities for processing personal data.

The authority also adds that digital platforms used for such voting should meet minimum criteria consistent with the GDPR and with broader cybersecurity and digital identity frameworks, including NIS2 and eIDAS2.

According to the office, such systems should comply with data minimisation requirements and ensure transparency and verifiability of the voting process, including auditability and verification of vote counting.

Would you like to learn more about AI, tech, and digital diplomacy? If so, ask our Diplo chatbot!