Many employers believe that they have the right to require their employees to provide information on their disability. This is because employers have an obligation to ensure that employees with disabilities can exercise particular privileges. The Personal Data Protection Office (‘PDPO‘) examined this issue in its position paper published on 24 August 2020, where it reminded that it is up to the employee to decide whether or not to provide such information.

PDPO emphasizes that disabled employees have the right but not the obligation to exercise the privileges provided for in the regulations concerning disabled employees. Pursuant to Article 2b (2) of the Act on Social and Vocational Inclusion and Employment of the Disabled of 27 August 1997 (“the Act“), the presentation to the employer of documents confirming personal information on health condition is voluntary.

Therefore, the employer’s obligations related to ensuring appropriate working conditions for employees with disabilities are set in motion only when the employee decides to provide the employer with data concerning his/her disability and presents relevant documents (according to Article 2a (1) of the Act, a disabled person is counted in the roaster of disabled employees from the date of his/her presentation of the disability certificate to the employer). The employer will process this data in order to fulfil his obligations under the provisions of the Act (in other words, with respect to data belonging to a special category, the processing will take place under GDPR Article 9.2 (b)).

What should be remembered:

The Act contains detailed regulations on securing the processed data on disability, according to which:

• Only persons having written authorisation issued by the data controller may be allowed to process personal data for the purposes arising out of the Act;
• Persons authorised to process data should be obligated in writing to keep it confidential.

It should be remembered that, in the light of PDPO explanations, it is assumed that granting an authorisation to process personal data in electronic form should be considered as the fulfilment of the duty to grant an authorisation to process personal data in written form.

The Act also provides for an additional obligation concerning employers, according to which they should review the usefulness of the processed data at least every 5 years.

In order to ensure compliance of their activities with the regulations, employers should take a comprehensive approach to the analysis of the types of personal data processed at the workplace and their flows within the organisation, so as to prepare appropriate authorisations and confidentiality declarations for HR department employees and implement procedures related to the review of data usability.

Can employers hold on to employees’ disability certificates:

PDPO also addresses the concerns of those employers who have wondered whether they can hold on to a copy of their employee’s disability certificate or whether they should only make a formal note of having seen it. According to PDPO, the employer should place a copy of the certificate in section B of the employee’s personal file.

Karolina Romanowska