The President of the Personal Data Protection Office met with the Lewiatan Confederation

The President of the Personal Data Protection Office, Mirosław Wróblewski, together with experts from the Office, met with representatives of the Lewiatan Confederation. The discussion provided an opportunity to exchange views on the scope of personal data protection in the broadly understood business sector.

During the meeting, issues related to certification and data processing in the context of supplier-customer relations were discussed. They also touched upon the increasingly relevant topic of the use of artificial intelligence in business, including in the area of human resources (HR), where artificial intelligence is increasingly used in the employee recruitment process to assess candidates' competencies. The Office's experts indicated that the Office plans to publish a guide on data processing in this context, but changes to the Labour Code are also necessary. Currently, it clearly specifies what candidate data may be processed and requires employers to be able to explain their recruitment decisions, which artificial intelligence systems do not guarantee at this point. This is important in terms of prohibiting discrimination against candidates.

An important topic of discussion was the issue of data controllers' responsibility and their relationship with joint controllers, especially when it comes to confirming the certification of contractors cooperating with a given entity. It was pointed out that, under the current conditions, controllers should demonstrate that they have analysed all available data protection solutions, as many entities in the business sector do not provide even basic data protection.

As noted by representatives of the Lewiatan Confederation, there are increasing indications that entrepreneurs feel the need to give internet users control over their own data and decisions. This is in line with the view held by the Office's employees for years that this may constitute a competitive advantage.

Experts from the Lewiatan Confederation emphasised that there is a serious conflict between the principle of data minimisation and the effectiveness of training artificial intelligence models. In their opinion, minimisation is beneficial for the protection of personal data, but for the development of AI models, it is quite the opposite, because the more data are excluded, the greater the risk of errors and inaccurate model results. Representatives of the Office recalled Opinion 28/2024 of the EDPB on certain data protection aspects related to the processing of personal data in the context of AI models and other ongoing work within the EDPB on issues related to AI, including guidelines on the interplay between the AI Act and EU data protection legislation, as well as on training AI models through web scraping. It was recalled that data protection impact assessments remains an effective solution and should be extended as soon as possible to include the perspective of artificial intelligence and respect for human rights in this area.