Poland - Data Management Act

Overview

The Draft Act on Data Management translates the EU Data Governance Act (DGA) into national law to enable safer and broader sharing and re-use of public-sector and privately held data. It establishes national institutions and procedures to facilitate re-use of certain protected public-sector datasets, to register and supervise neutral data intermediaries, and to certify organisations engaged in altruistic data sharing. Key national implementers named in the Draft are the President of the Personal Data Protection Office (Prezes UODO) and the President of Statistics Poland (Prezes GUS). For official project information see the Ministry of Digitalisation’s project page (Projekt ustawy o zarządzaniu danymi (gov.pl)) and the Rada Legislacyjna opinion of 20 September 2024 (Rada Legislacyjna – opinion).

Definitions

The Draft defines: "re-use" as use of data held by public-sector bodies for purposes other than original public tasks; "protected data" as categories shielded for confidentiality, intellectual property, personal-data reasons, or other legal protections; "data intermediation services" as neutral third-party offerings that facilitate data exchange (without exploiting the data for their own purposes); and "data altruism" as voluntary sharing of data for general-interest goals. These definitions align closely with terms set out in Regulation (EU) 2022/868 and are tailored to interact with Polish public-administration terminology.

Governance and Institutional Framework

The Draft assigns supervisory and support roles between national authorities. The President of UODO is designated as the competent supervisory authority for registering and monitoring data intermediation service providers and for maintaining the register of organisations of data altruism, including issuing trust marks. The President of GUS is appointed to provide technical assistance to public-sector bodies (secure environments, pseudonymisation, data structuring) to facilitate lawful re-use. The Ministry of Digitalisation is mandated to operate an information point providing guidance on datasets and application pathways. These institutional roles are intended to ensure co‑ordination between data-protection oversight, statistical expertise and user-facing information services; see the project announcement on the Ministry portal (gov.pl – Ministry of Digitalisation) for detail.

Key Focus Areas

The Draft centres on four primary topics: (1) procedures for re‑use of protected public-sector data — including application forms, 14‑day offer acceptance windows and fee principles tied to cost recovery; (2) a registration and supervision regime for data intermediation services requiring notification to UODO, neutrality obligations, and prohibitions on reusing transferred data for proprietary purposes; (3) a voluntary registration and trust-mark scheme for organisations enabling data altruism, with UODO oversight and a dedicated logo to signal compliance; and (4) controls on transfers of non-personal data to third countries, with powers for UODO to open administrative proceedings and impose sanctions for unlawful transfers. Complementary rules address secure environments for data access, technical assistance by GUS, metadata standards and documentation obligations to enhance transparency and interoperability.

Implementation Framework

The Draft creates procedural timelines and administrative flows: public-sector bodies must evaluate re-use requests and either provide an offer or refuse by a reasoned decision; if assistance is requested, Prezes GUS must respond within 21 days (draft text timelines); data intermediation providers must submit notifications and comply with ongoing supervisory reporting; organisations of data altruism may apply for registration and trust‑mark allocation, subject to review. The Draft contemplates publication of registers, templates for offers, and rules for fees to avoid discriminatory conditions. Administrative decisions (e.g., refusals, fines) are subject to standard administrative appeal and judicial-review channels.

Monitoring and Evaluation

The Draft requires periodic reporting by registered intermediaries and by altruism organisations to the supervising authority (UODO) and mandates that UODO and GUS publish aggregated supervisory statistics and annual activity reports. Monitoring focuses on compliance with neutrality obligations, correct handling of personal-data elements, secure transfer mechanisms, and fidelity to registration conditions. The Draft foresees coordination mechanisms with other oversight institutions (e.g., data-protection authorities and sectoral regulators) to track market development and systemic risks.

Penalties, Liability, and Appeals

The enforcement regime uses administrative decisions and fines calibrated on the DGA framework: examples in the Draft include fines up to EUR 50,000 for failure to notify, up to EUR 500,000 for material breaches of intermediary obligations, and up to EUR 5,000 for breaches by registered altruism organisations. The Draft also allows the imposition of corrective measures (orders to cease or suspend activities) and requires compelled production of documents within 30 days for enforcement purposes. Decisions by UODO are subject to judicial review before administrative courts following Polish administrative-procedure rules.

Relationship to Other Instruments

The Draft explicitly references the EU Data Governance Act (Regulation (EU) 2022/868) as its primary normative source and is designed to operate alongside GDPR and national data‑protection law. It also intersects with Polish laws on public‑sector information re‑use, intellectual property, administrative procedure (k.p.a.), and cybersecurity rules. Rada Legislacyjna’s opinion (20 Sept 2024) addresses specific drafting issues such as the application of administrative‑procedure rules to UODO proceedings; see the Rada Legislacyjna opinion for detailed drafting remarks (Rada Legislacyjna opinion).

International Alignment

The Draft is explicitly designed to implement the EU DGA and to align Polish domestic law with EU harmonisation objectives for a trusted data‑sharing ecosystem. It contains provisions addressing transfers of non‑personal data to third countries and envisages cooperation mechanisms with EU bodies as required by Regulation (EU) 2022/868. The Act therefore supports Poland’s participation in European Data Spaces and is intended to be consistent with overarching EU privacy and cybersecurity frameworks.

Implementation Timeline

Sources and References