Poland : reducing the gap in privacy protection Andrzej Adamski

1. Public Voice Symposium"Privacy in a New Era: Challenges, Opportunities and Partnerships"September 13, 2004Wroclaw, Poland Poland : reducing the gap in privacy protection Andrzej Adamski Nicolaus Copernicus University in Toruń aadamski@law.uni.torun.pl

2. Agenda • An overview: from the Martial Law to the Digital Age, • Privacy vs. security – some recent developments: • police databases, • retention of traffic data, • interception of communications. • The role of institutional controllers and civil society groups. Wroclaw, 13 September 2004

3. The 80’ • The Martial Law period (31 Dec. 1981 to 22 July 1983) • General suspension of civil liberties, • „your conversation is under monitoring” , • first wiretapping provisions in the Criminal Procedure Code (1982). • The Constitutional Tribunal (1985), • The Ombudsmen (1987), • Shortagesin privacy protection laws. Wroclaw, 13 September 2004

4. Legal framework for privacy Implementation of the European and international standards in privacy protection : • ECHR ratified in 1993, • Constitution of 1997 (articles 31,47,49 and 51), • Data Protection Act of 1997, • Code of Criminal Procedure of 1997, • CoE Convention no. 108 signed in 1999, ratified in 2002, • The Telecommunication Act of 2000. Wroclaw, 13 September 2004

5. Legal framework for security • The Classified Information Protection Act of 1999, • The Police Act amendments of 2000 and 2001, • The Criminal Information Act of 2001, • The Telecommunication Act of 2004. Wroclaw, 13 September 2004

6. Balancing Security and Privacy • Current problems in privacy & personal data protection: • POLICE DATABASES: no right of individual access, excessive collection and storage of data; • INTERCEPTION OF COMMUNICATIONS: limited judicial oversight, deprivation of the right tojudicial remedy; • TRAFFIC DATA RETENTION: insufficient regulations. • Main actors: • the Ombudsman, • the Constitutional Tribunal Wroclaw, 13 September 2004

7. POLICE DATABASES • the 2001 Act on the Gathering, Processing and Transmission of criminal information : • database under control of DPIG, • data subjects’ access to their own files (article 32 sec. 3 DPA) is excluded. • NOT COMPATIBLE with: • CoE Convention no. 108, and the Recommendation No.R (87) 15 on the use of personal data in the police sector. Wroclaw, 13 September 2004

8. POLICE DATABASES (2) • Fingerprints and photographs of suspects, found unguilty, are kept in LE databases ( the right to oblivion, purpose specification principle) • Ombudsman: not compatible with the CoE Recommendation No.R (87) 15 • Government: compatible with the 1990 Police Act (the time of storage is not specified, as long as data are useful for LE) • Ombudsman – motion to the Constitutional Tribunal (art. 51 sec.2, art.31 sec.3 of the Constitution) Wroclaw, 13 September 2004

9. Constitutional approach • Hierarchy of legal norms, • Adherence to general constitutional principles in any legal regulations concerning human rights, • Specific requirements: any rules which limit fundamental rights must be: published, in a precise terms (be foreseeable),in a formal statute, and • may not affect the ”untouchable core” of the right concerned, • must be in accordance with the principles of „necessity” and „proportionality” (ECHR art. 8, Polish Constitution, art. 31 sec. 3) Wroclaw, 13 September 2004

10. „Tax amnesty" and property declarationslaw (2002), • Government’s bill on mandatory property statements for citizens, • Parliament passed the law, • Ombudsman:law is contradictory to the Constitution (art. 51 sec.2), excessivecollection of information regarding citizens • President’s refusal to sign up the law, • Referral of the law to the Constitutional Tribunal, • Tribunal’s judgement : the law is unconstitutional. Wroclaw, 13 September 2004

11. Interception of communications • Monitoring of communications of persons suspected of a commission of crime, • No formal status of a defendant, no rights, • If notaccused, they are: • unaware about being under monitoring, • not able to exercise the right to judicial remedy. • Ombudsman: Articles: 7, 51 sec.4, and 31 sec. 3 of the Constitution at stake. Wroclaw, 13 September 2004

12. DATA RETENTION • „electronic fingerprints”, traces • Ministerial draftregulation of 2001– mandatory monitoring of traffic by ISP’s • Strong criticism of The Polish Chamber of Information Technology and Telecommunications (PIIT) on constitutional grounds • Ministry of Infrastructure regulation of 2003,went into force, not in compliance with the Law on the performance of electronic services from 2002, • The Telecommunication Act of 2004 (article 165 – mandatory retention of traffic data for 12 months). Wroclaw, 13 September 2004

13. Concluding remarks • The need for balance between civil rights and the efficiency in government, • The legal tools: human rights instruments and data protection legislation, • The main actors: Ombudsman, Constitutional Tribunal, • The role of civil society organisations. • Effects: reduced gap in privacy protection – clearly visible from the historical perspective. Wroclaw, 13 September 2004