The obligation to present an information clause (i.e. to fulfil the information obligation) towards a contracting party depends on the type of entity with which the institution establishes cooperation. The GDPR applies exclusively to natural persons. This article outlines the categories of entities towards which the controller is required to fulfil this obligation.
When an Information Clause Is Required…
The data controller is obliged to fulfil the information obligation towards:
- A natural person – meaning any situation in which the contracting party is an individual, e.g. Jan Kowalski, and the agreement is concluded directly with this person (as opposed to a company represented by Jan Kowalski).
- A sole trader (natural person conducting business activity) – according to the Polish Civil Code (Art. 434), the business name of a natural person is their first and last name. To determine whether the contracting party is a sole trader, it is sufficient to analyse the business name – for instance, “ABC Service Enterprise Jan Kowalski” indicates that the counterparty is a sole trader, and therefore the information obligation applies.
- Partners in a civil law partnership – a civil law partnership (abbreviated as “s.c.” in Polish) is a contractual relationship between partners. It does not create a new legal entity; the partners are bound by an obligation-based relationship. As such, the partners representing the partnership should be treated similarly to the aforementioned categories: natural persons or sole traders.
…And When It Is Not Required
The information clause is not provided to other types of entities – namely, companies governed by commercial law (as indicated by elements such as sp. z o.o., S.A., sp.j., sp.p., sp.k., S.K.A.), associations, foundations, cooperatives, and public authorities (in short: legal persons and organisational units without legal personality but with legal capacity granted by statute).
If the Institution Signs a Recurring Lease Agreement with the Same Sole Trader, Is It Necessary to Provide the Information Clause Each Time?
No. In such cases, it is sufficient that the obligation was fulfilled upon the first conclusion of the agreement. According to Article 13(4) of the GDPR, if the data subject already possesses the information contained in the clause, there is no need to present it again. However, the data controller must be able to demonstrate that the obligation was originally fulfilled (in accordance with the accountability principle).
The Institution Concludes an Agreement with a Foundation, but a Natural Person Signs It – Is the Information Obligation Required in This Case?
No, because the contracting party is a legal person – the foundation. The fact that a natural person signs the agreement is irrelevant, as that person is acting in an official capacity on behalf of the organisation they represent.
Summary
The information obligation must be fulfilled towards: natural persons, sole traders, and partners in civil law partnerships.