Meeting on the Code of Conduct for the Media

The formal requirements concerning the GDPR Code of Conduct, areas which can be regulated by such a Code and the benefits of its application - these are the topics that were raised during the Personal Data Protection Office meeting with media representatives.

On October 20, the first meeting on the Code of Conduct for the Media was held at the Personal Data Protection Office headquarters, which was initiated by the regional radio stations of the Polskie Radio. Media communities are interested in the creation of the code of conduct for the media industry that would facilitate the application of the GDPR. It would clarify certain requirements or standards of conduct in areas that today pose difficulties for many editorial teams, such as the implementation of the right to be forgotten, or the safeguards applicable to processed data and data publications. The fact that the media have problems with the proper application of the provisions on the personal data protection is evidenced by the decision of the President of the Personal Data Protection Office imposing an administrative fine on Radio Szczecin S.A. (thedecision was declared correct by the Voivodeship Administrative Court in Warsaw).

Roman Sobotka from the Law and New Technologies Department of the Personal Data Protection Office discussed the role of codes of conduct, the procedure for their creation and approval by the President of the Personal Data Protection Office. He also explained who can join such a code and what benefits it brings.

During the meeting, the Personal Data Protection representatives pointed out that the advantage is undoubtedly the development of certain standards of conduct that are characteristic of a given industry and constitute a clarification of the general requirements of the GDPR. The experience of the supervisory authority so far shows that members of approved codes of conduct protect data better, which is due to the lack of (so far) complaints against them and the small number of data breaches they report.

The meeting was also an opportunity to clarify the role of the supervisory authority in the creation of such a code. The Personal Data Protection Office representatives emphasised that it is the organisation associating controllers or data processors that must determine what area and how it wants to regulate it. The Personal Data Protection Office performs advisory functions in this regard. The draft code is subject to public consultation and submitted for approval by the supervisory authority. If the code meets the relevant requirements, it is approved by the President of the Personal Data Protection Office. This happens at the same time as accreditation for the monitoring body.

During the talks, much time was also devoted to clarifying the rules on operating by the monitoring body and the role of data protection officers in the preparation of the draft code of conduct.

Representatives of the office also pointed out that the code does not have to apply to all requirements of the GDPR.

It is worth focusing on a few of the most important areas for a given industry, so that the code is a response to the sensitive needs of a given market. In the future, such a code can be expanded with additional elements," said Monika Krasińska, Director of the Law and New Technologies Department at the Personal Data Protection Office. She explained that it was important to focus on several areas, given the difficulties in drafting such a document and its volume.

The meeting ended with a declaration of further cooperation.

All information on codes of conduct, including notified initiatives and approved codes, can be found on the Personal Data Protection Office website in the dedicated tab: https://uodo.gov.pl/pl/426

The problems faced by the modern media in connection with the need to reconcile the protection of personal data with informing the public were extensively discussed during the conference "Personal data on air". During this meeting, it was also pointed out the need to develop an industry code of conduct that would facilitate operating in the area of personal data protection.