After the speech of the UODO President, the Ministry of the Environment and the Climate declares that it will clarify new disposals on the video control in dumps.

The Supervisory Authority has asked to the Ministry of Climate and Environment, at the end of 2020, to start changes relating to provision of the legislation of the 14^th of December 2012 on wastes in order to guarantee the compliance with the GDPR.

Three groups of problems

The Supervisory Authority has indicated that subjects that are dealing with the waste storage inform it about their doubts on the implementation of the regulation. They refer to three groups of questions:

• determination of roles of entities into process/processes oof personal data with the usage of video controlling in dumps;
• rules of access to the registered image;
• security of personal data transferred by the ITC system.

After having analyzed the applicable disposals of the legislation on waste, the Supervisory Authority has decided that is justified clarifies in order to obtain the compliance with the GDPR.

What necessitates clarification?

In its intervention, the Authority has underlined that provision of the legislation on wastes do not clarify for which purposes and under which conditions both collectors of wastes and inspectors of personal environmental protection into the Voivodeship (WIOS).

Meanwhile, the correct definition of the role carried out is fundamental for determining who is responsible for the fulfilment of administrator obligations, including the personal data breaches, the implementation of data subject’s rights or for the obligation of information for people which data will be processed by the video surveillance into dumps.

At the same time, UODO has underlines that the status of administrator can not be modelled in an abstract way, by neglecting the aims for which personal data are processed. For this reason, the legislator shall define in a clear and confinable way into disposals of the legislation to who and in what measure are assigned the purposes and moods of the processing of personal data. Only such formation of the legal standard will satisfy the principles of lawfulness, correctness and transparency (Article 5, paragraph 1, letter a), of the GDPR).

It also stressed that the purposes for which monitoring data need to be obtained from VIEP were not sufficiently clearly indicated. Of course, article 25, paragraph 6, letter g) of the Waste Act indicates the use of real-time access to the recorded image by the environmental protection inspector of the voivodeship, however, there are no regulations that constitute a direct legal basis for these inspectors to register and thus store the personal data contained in the registrations. Since it does not appear from the provisions of the Waste Act that inspectors are required to carry out monitoring in the performance of public tasks, should be able to make decisions relating to the processing of monitoring data on the basis of clearly defined legal criteria, which will be consistent with the principle of compliance with the law – article 5, paragraph 1 letter a) of the GDPR (principle of lawfulness, fairness and transparency).

Doubts of the supervisory authority were also raised by the obligation imposed by the provisions of the Waste Act to provide VIEP with information allowing access to the visual inspection system of the place of storage or storage of waste. Therefore, it stressed that if the entity managing the waste dump (equipped with a visual inspection system) and the environmental protection inspector of the voivodeship have to use the same ICT system, then as regards the processing of personal data, solutions should be introduced – separately for each user of the system – the security of the processing of personal data. Persons having access to the information collected in this system, acting on behalf of the entity managing the landfill or on behalf of the competent inspector, should have separate permissions to process data in this system and also assign individual passwords and logins, not transferred between authorized entities. Please note that the relevant legislation will comply with the provisions of article 5, paragraph 1, letter f) Principles of integrity and confidentiality of the GDPR.

Ministry statement

In response to this speech, the Ministry of Climate and Environment stated that work in this area would be undertaken as part of one of the planned amendments to the Waste Act.

SOURCE: AUTORITA’ PER LA PROTEZIONE DEI DATI DELLA POLONIA – UODO