Translation of a Privacy Policy into Polish – GDPR issues
This article is not intended to provide legal advice. If you are interested in how the GDPR and other privacy laws apply to your specific situation in Poland or elsewhere, consult an expert law firm.
translation of a privacy policy into Polish
The fast-growing international trade and the development of online sales and services are an incentive for businesses to address their offer to customers in other countries, very often (other) European Union Member States, including Poland. Starting to provide services or selling products abroad is most often associated with the translation of the company website into a local language, for example, Polish. Since the entry into force of the GDPR, or Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), companies have had certain obligations set out in this act related to the processing of personal data of their customers who are natural persons. There are a number of things that must be taken care of in this regard, and one of the issues you might have been wondering about if you are planning to launch your website for the Polish audience is if there is any requirement to provide a translation of your privacy policy into Polish.
Information obligation
One of the main obligations imposed on data controllers is the information obligation. The GDPR has significantly expanded the catalogue of information that should be provided to the data subject. Article 13 of the Regulation states that when collecting personal data from the data subject, the controller shall provide, inter alia, such information as their identity and contact details, contact details of the data protection officer, the purposes of processing along with the legal basis, legitimate interests pursued by the controller or a third party (if this is the basis for processing), information about data recipients, and information about the intention to transfer data to a third country or an international organisation. The controller shall also provide other information necessary to ensure the fairness and transparency of processing, including the period of data storage, information on the rights of the data subject, information on whether the provision of data is a statutory or contractual requirement or a condition for entering into a contract, information if the data subject is obliged to provide data and what the consequences of not providing them are, as well as information about any automated decision making, e.g. profiling.
Sanctions
Before the entry into force of the GDPR and just after that date, entrepreneurs rushed to create or update the privacy statements or policies on their websites so as not to be exposed to possible administrative penalties that may be imposed for failure to comply with GDPR obligations. Although penalties are not the only instrument that the authorities can use (warnings and reprimands may also be issued), the astronomically high maximum sanctions effectively “encourage” business owners to take the GDPR seriously (regardless of the criticism this Regulation often comes under). More on this issue can be found on the website of the Polish Office for Personal Data Protection: https://uodo.gov.pl/pl/138/1244.
Should you translate your privacy policy?
Having analysed the GDPR requirements, entrepreneurs are faced with the question of whether the privacy policy or privacy statement of their store or website should also be posted in a foreign language, e.g. if they offer their products, content or services to Polish customers, should they post a Polish version of the policy, or is the English one enough? Notably, the provisions of the GDPR do not impose such a requirement directly. However, it is worth paying attention to recital 39 of the Regulation:
Any processing of personal data should be lawful and fair. It should be transparent to natural persons that personal data concerning them are collected, used, consulted or otherwise processed and to what extent the personal data are or will be processed. The principle of transparency requires that any information and communication relating to the processing of those personal data be easily accessible and easy to understand, and that clear and plain language be used.[…]
Likewise, Art. 12(1) of the Regulation stipulates that:
The controller shall take appropriate measures to provide any information referred to in Articles 13 and 14 and any communication under Articles 15 to 22 and 34 relating to processing to the data subject in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. […]
For non-English-speaking individuals to whom the entrepreneur’s offer is addressed and whose data may therefore be processed, becoming familiar with the mandatory information that the entrepreneur as a data controller is to provide will be rather difficult if the translation is unavailable. It seems that in this case, the GDPR obligation to provide relevant information in a concise, transparent, intelligible and easily accessible form is not met.
Translating a privacy policy into 7,000 languages of the world?
However, taking into account the cross-border reach of the Internet and the fact that a company’s services can be used by consumers from as many as 27 European Union countries who speak many more languages, the question arises whether the privacy policy or the relevant information clause should be translated into all languages potentially used by consumers… Well, we can imagine that our Polish website could possibly be used by people from other countries, not necessarily speaking Polish or even not located in Poland. This would lead to a large increase in the number of language versions of the website, which only the largest companies can afford. In practice, a simple rule that can be adopted here is that the privacy policy should be available in the same languages as those in which the website itself is available. For example, if a website has been translated into Polish, a Polish translation of the privacy policy should be found there as well. What are the advantages of this approach? First, the rationale for this solution is that it can be reasonably assumed that if someone decides to use a website in a given language, they should do so responsibly, that is, taking into account their own language skills. Based on the above example – if someone uses a Polish website without knowing the language, they are taking a certain risk. Hence, a translation of the privacy policy into the language in which the user uses the website seems to be an adequate measure that allows the website owner to oppose an allegation of non-compliance with the information obligation. However, the answer is not full yet.
Privacy policy translated with an automated translation service?
Another question arises – how should the privacy policy be translated? At this point, I will again refer to the example of the Polish language, which is due to my own translation experience in this field. Unfortunately, the translation of a privacy policy into Polish is often treated as a sad necessity (“Why to do so?”, “Everyone knows English”, etc.), but this approach does not bring benefits to businesses and may entail unnecessary costs. The translation of a privacy policy is not as simple as it may seem, and it is no good underestimating it. There are two main reasons. First, a privacy policy deals with legal issues. The GDPR has a specific set of terminology, and it is easy to get confused by the terms used there without proper knowledge of the content and context of this act or, to make matters worse, by resorting to online translation tools. The precise application of these legal concepts is necessary in order to communicate the information that should be provided to the data subject under the law. On the other hand, the Regulation refers to transparency and intelligibility as well as clear and plain language. Here the EU legislation presents a tough challenge that many lawyers or legislators struggle with – to talk about difficult legal issues in a way that is understandable to the average recipient, not a specialist. Elements that matter in this regard include grammar, in particular sentence structure, style, and the selection of appropriate, comprehensible vocabulary. The use of simple language does not mean simple translation – quite the opposite. A proper translation of a privacy policy is consistent and accurate in terms of content and is characterised by linguistic correctness and an appropriate style.
Translation of a privacy policy into Polish – conclusions
To sum up, if a website or online store is available in a foreign language, for instance, Polish, it is also worth making sure that the GDPR information obligation is met in this language. Posting a professionally translated privacy policy in Polish on your Polish website may help avoid possible misunderstandings with customers (and them lodging complaints with the President of the Office for Personal Data Protection) or the consequences of supervisory authorities’ sanctions.
EngLaw support
At EngLaw, you can rely on professional GDPR-related translation services. The translation of your privacy policy into Polish will be performed by a sworn translator with a legal background specialising in the translation of privacy policies, terms and conditions, and other legal documents into Polish. Translations are offered locally for clients from the Silesian region as well as remotely throughout the country and around the world.
Feel free to use our professional certified and ordinary translation services.
Sworn translator of the English language: Ruda Śląska Halemba
Sworn translator of the English language: Gliwice, Katowice, Mikołów, Zabrze and the Upper-Silesian region
Remote and online services around the world
Post your comment