An officer of the Internal Security Agency (ABW) approached the school requesting access to information about a student, such as years of attendance, disciplinary issues, etc. (from the years 2007–2010). He presented his service ID and stated that, as an ABW officer, he does not require specific authorization to obtain information about an individual (this allegedly results from the law). No official letter requesting the disclosure of information was submitted to the institution.

Can the school disclose the above data to ABW without violating the GDPR?

According to the Act of 24 May 2002 on the Internal Security Agency and the Intelligence Agency, government administration bodies, local government bodies, state institutions, and entrepreneurs providing public utility services are obliged, within their scope of activity, to cooperate with the Agencies, and in particular to provide assistance in carrying out the tasks of the Agency (Article 10 of the Act). This is also confirmed in Article 23(1)(7) of the Act.

Article 34(1) of the Act provides that, within its competence, the Agencies may collect, also covertly, any personal data, including, if justified by the nature of their tasks, the data referred to in Article 14(1) of the Act of 14 December 2018 on the Protection of Personal Data Processed in Connection with the Prevention and Combating of Crime (Journal of Laws 2019, item 125), as well as use personal data and other information obtained as a result of operational and reconnaissance activities carried out by authorized bodies, services and state institutions, and process such data without the knowledge or consent of the data subject.

However, paragraph 2 of the above provision states that the data controller is obliged to disclose the personal data referred to in paragraph 1 on the basis of a personalized authorization issued by the Head of ABW or the Head of AW, presented by the officer along with their service ID.

Therefore, the school may disclose personal data to an ABW officer, provided that the officer presents a personalized authorization issued by the Head of ABW, along with their service ID.