The Polish data protection authority (UODO) has raised objections regarding a proposed revision of the law on family foundations, which plans to make public online the personal data of individuals associated with them.

The president of the UODO has expressed serious concerns about two proposed amendments. The first aims to integrate the family foundations register into the National Judicial Register and to publish online the personal data it contains. The second would grant the National Tax Administration (KAS) permanent and full access to the register and its files, in order to prevent abuses. The supervisory authority emphasizes that the information held by these foundations is often sensitive, relating to family and personal life, and may include special category data protected by Article 9 of the GDPR, national identification numbers (PESEL), or information covered by legal secrets. The publication of this data would mostly concern individuals not holding public functions.

The UODO considers that the permanent access of the tax administration to data of individuals not subject to any procedure is questionable with regard to the right to privacy and the presumption of innocence. The authority recalls the case law of the Court of Justice of the European Union, notably the *Luxembourg Business Registers* ruling (C-37/20 and C-601/20), which requires that public access to information be limited to what is strictly necessary and proportionate. It recommends adopting less invasive solutions and asks the legislator to ensure GDPR compliance by incorporating adequate safeguards for the rights and freedoms of the data subjects.