The President of the Polish Data Protection Authority (UODO) has shared his observations with the Minister of Health regarding the "mojeIKP Junior" service project, intended for adolescents aged 13 to 17.

The authority emphasizes that the service will process health data of minors, a special category of data protected under Article 9 of the GDPR, which requires a high level of protection and communication adapted to their maturity. It is imperative to integrate data protection safeguards from the design phase, in accordance with Article 25 of the GDPR, and to conduct a data protection impact assessment before launching the service pursuant to Article 35 of the GDPR. The President of the UODO notes the absence of a clear legal basis, which must define the purpose, scope, categories of data, authorized entities, and retention periods. Furthermore, the project does not identify the data controllers and must clarify the legal status of the minor patient as well as the access rights of their legal representatives. Finally, compliance with the European Health Data Space (EHDS) regulation must be assessed.