Sejm RP jako administrator danych osobowych. Jak zrównoważyć efektywną realizację zadań publicznych parlamentu z obowiązkiem ochrony jednostek?

The view about the necessity to apply the EU General Data Protection Regulation (GDPR) to the core activity of national parliaments which have the status of controllers within the meaning of the GDPR (insofar as the parliaments determine the purposes and means of the processing of personal data) has met with skepticism among European legal scholars. In the EU Member States, such an approach is even more resisted by the national parliaments themselves. Also, the Sejm of the Republic of Poland does not consider itself to be the said controller and, consequently, it does not apply the GDPR to its legislative, oversight and political activity (by contrast, the application of the GDPR by the Chancellery of the Sejm, in its capacity of a controller, is another matter entirely). The literal, systemic and teleological interpretation of the GDPR provisions as well as the recent judgments of the Court of Justice of the EU mandate a radical change of this old paradigm, which in turn requires specific amendments to the respective Polish law and particular modifications to the parliamentary practice.