Recording meetings in Poland.
Poland's criminal provision turns on a phrase worth understanding precisely: information not intended for the person obtaining it. That is what separates the everyday case from the serious one.
The General Data Protection Regulation applies here of its own force rather than through a national translation of it, and the national act below handles the parts member states are left to decide for themselves. The supervisory authority enforces both. In Poland that is the Act of 10 May 2018. Alongside it, Article 267 of the Kodeks karny addresses unlawfully obtaining information, including through the use of a recording device, where that information was not intended for the person concerned.
The phrase not intended for the person doing so is the hinge. A participant in a meeting is, by definition, someone the conversation was intended for, which is why their situation is analysed differently from someone recording a conversation they are not part of. That does not dispose of the data protection question: a lawful basis, transparency at the time, and bounded retention all still apply. A practical note on sources: UODO publishes much of its material in Polish only, so English summaries of Polish practice are frequently translations of translations.
- The data protection instrument
- Ustawa o ochronie danych osobowych (Personal Data Protection Act), Act of 10 May 2018
- Who supervises this
- Urząd Ochrony Danych Osobowych (Personal Data Protection Office)
Criminal provisions
These sit alongside data protection law rather than replacing it. They generally address conduct that is covert or that involves conversations the recorder was not part of, which is a narrower category than everyday meeting recording, and a considerably more serious one.
Kodeks karny, Article 267
Criminal Code
Unlawful obtaining of information. The provision addresses, among other conduct, using a recording device to obtain information not intended for the person doing so.
What is specific to this country
- The GDPR applies directly in Poland rather than through a national equivalent. A meeting recording that identifies the people in it is personal data, so making, storing and sharing it is processing, and it needs a lawful basis under Article 6.
- Transparency is a separate obligation from lawful basis. Article 13 requires that people are told what is being collected and why at the time it is collected, which for a meeting means at the start rather than afterwards.
- Article 267 turns on information not intended for the person obtaining it, which is why a participant recording their own meeting is analysed differently from someone recording a conversation they are not part of.
- UODO publishes guidance in Polish only for much of its material, so an English-language summary of Polish practice is usually a translation of a translation. Check the original before relying on it.
What to do in practice
The practice below is not the legal minimum in every jurisdiction. It is the practice that is defensible in all of them, which is a more useful target when your calls cross borders.
- Say it out loud at the start, before anything substantive is discussed, and say what the recording is for. Not a line in the invite nobody read.
- Give people a real way to decline. An announcement that leaves no room to object is closer to a notification than to consent.
- Write it down. A line in the notes recording that the meeting was recorded, and that nobody objected, is worth more later than anyone's memory of the moment.
- Keep external meetings to a higher standard than internal ones. Colleagues share an employment context; a customer, a candidate, or a supplier does not.
- Decide how long you keep recordings, and actually delete them. Indefinite retention converts a small, well-handled recording into a growing liability.
- Treat sharing as a fresh decision. The question is not whether you were allowed to record, it is whether this particular person was meant to hear it.
Questions
Does Article 267 cover recording a meeting I am in?
It is framed around obtaining information not intended for the person obtaining it, which does not naturally describe a participant. The data protection layer is where the ordinary meeting question is answered. A Polish lawyer can tell you how that applies to a specific situation.
Where should I check Polish practice?
UODO's own site, in Polish. Much of the material is not published in English, and the English-language secondary sources on Polish data protection practice are frequently out of date.
Does Poland add obligations beyond the GDPR?
The 2018 Act handles the areas the Regulation leaves to member states, including some employment-related provisions. The core obligations for a meeting recording come from the Regulation itself.
Sources
Primary sources, so you can check this rather than take our word for it.
Recording that announces itself.
Canto's notetaker joins as a named participant the organiser admits, and the recording, the transcript and who can see it stay under your control. 300 minutes a month, free forever.