The European Commission has initiated an infringement procedure (INFR(2026)2130) against Poland due to the lack of provisions ensuring adequate supervision of the processing of personal data in the fields of public order and justice.

This procedure follows multiple alerts from the Personal Data Protection Authority (UODO) concerning the incorrect transposition of Directive (EU) 2016/680 by the law of 14 December 2018. The UODO highlighted that numerous exclusions in the national law deprive protection to data processed within judicial proceedings, without guaranteeing the fundamental rights of the data subjects such as the right of access, rectification, or appeal. The supervision of data processing by courts and public prosecutors is also deemed deficient, notably due to the absence of truly independent supervisory bodies outside judicial and hierarchical structures, resulting in a fragmented system and divergent interpretations.

Other identified breaches include the lack of effective, proportionate, and dissuasive sanctioning powers for the UODO, a non-compliant definition of the data protection officer's tasks, as well as provisions considered too general to ensure effective protection. The UODO also noted that these shortcomings affect the proper functioning of large-scale information systems of the European Union in Poland. The authority expressed hope that the Commission's procedure will accelerate the adoption of legislative measures to bring Polish legislation into full compliance with Union law.