The pay data act: what the state collects and what it will not show.

The Act of 19 June 2026 allows the minister of health to collect from facilities data on the pay of each person working in them, labelled with the PESEL number (the Polish personal identification number) and the number of the licence to practise (PWZ).¹ From such data one person’s payments from several facilities can be added up for the first time. In its data protection impact assessment, the government stated that this had not been possible before.² The act has been in force since 5 August 2026.³

Below we discuss what exactly its text says: how Article 27a of the Act on medical activity has changed, what data it covers, who receives them and what the act does not provide for.

Three articles

The act has three articles.¹

• Article 1 amends the Act on publicly funded healthcare services. In Article 31lc, which governs the data that facilities with an NFZ contract hand over to the Agency for Health Technology Assessment and Tariff System (AOTMiT), it deletes the word “anonymised” (paragraph 2 point 5 and paragraph 4b point 2) and adds the PESEL number and the number of the licence to practise (paragraph 2 points 6–7 and paragraph 4b points 2a–2b). It also gives AOTMiT new tasks: analytical work commissioned by the minister in connection with the purposes of Article 27a, and handing the results to the minister (Article 31n point 4h and Article 31o(2) point 1n).
• Article 2 gives new wording to Article 27a of the Act on medical activity, that is, to the obligation to hand over data to the minister of health.
• Article 3 provides that the act enters into force 14 days after its publication.

The government bill reached the Sejm on 16 June 2026 as print no. 2685. The Sejm passed the act on 19 June: 253 MPs voted in favour, none against, 177 abstained. On 25 June the Senate made no amendments, and the president signed the act on 17 July.⁴ It was published in the Journal of Laws on 21 July and entered into force on 5 August 2026.³

Article 27a before and after the amendment

The amendment deleted the word “anonymised” only in Article 31lc. Article 27a did not lose a single word; it received an entirely new wording.¹ In the previous version, published in the consolidated text of February 2026, a facility handed over to the minister, at the minister’s request, “aggregate data” on its employees, and the minister could process them for only one purpose: ensuring equal access to healthcare services.⁵

The most important difference is in the first rows. Aggregate data described the facility: how many people it employs and how much it pays them. The new wording requires each person to be described separately and labelled with two numbers. Only this makes it possible to compare payments to the same person from different facilities, and also from different contracts within one facility. This is exactly how the government’s data protection impact assessment describes the purpose of processing.²

Nine items of information about each person

Article 27a(1) lists the data that a facility collects and hands over: the number of employees (point 1) and nine items of information about each person (point 2(a)–(i)).¹ Seven of them ((c)–(i)) were in the provision before in a general form. New are both numbers. Two things have changed in the old fields: hourly rates have been added to pay, and instead of education “held or required”, the provision now asks only about the education required for the post.⁵

Three fields carry a proviso: hourly rates “where applicable” (point (c)), professional titles “if held” (point (e)) and specialisations “where applicable” (point (h)). The act does not say who decides, or by what criteria, whether a field applies to a given person, so in practice this will be judged by the facility that fills in the compilation.¹ According to the data protection impact assessment, facilities are to upload completed Excel files to a web application.²

The “working time” field (point (d)) will not show how much someone actually worked. The Labour Code uses this concept for an employee and calculates it from standards, not from the rota.⁷ The act does not create a record of hours actually worked, including on-call duty in several facilities. Work above an average of 48 hours a week with the doctor’s consent, the so-called opt-out under Article 96 of the Act on medical activity, is described in our texts on multiple jobs and on contract and employment. Article 96 itself is to be repealed with effect from 1 January 2028.⁸

Who is covered by the obligation

The obligation applies to every “entity performing medical activity” (podmiot wykonujący działalność leczniczą). This concept covers healthcare providers in all legal forms, including companies, as well as the professional practices of doctors, nurses, physiotherapists and laboratory diagnosticians.⁸ The regulatory impact assessment estimates the number of healthcare providers alone at about 18,042, by REGON numbers. It does not list professional practices under this heading.²

Data flow: only on request

Article 27a does not work by itself. It is triggered by the minister’s request, and the facility collects and hands over data “within the time limit and in the manner indicated by the minister” (our translation).¹ Beyond that, the flow looks like this:

1. The minister sends a request to the entity and sets in it the deadline, the method of handing over the data and, if the minister wishes, their recipient.
2. The recipient is the minister or, if designated in the request, the NFZ, the unit subordinate to the minister responsible for information systems in healthcare (paragraph 3) or AOTMiT (paragraph 4). Designating the agency is an option, not an obligation.
3. The data serve the purposes in paragraph 2: equal access to healthcare services, analytical and forecasting work, and review of the legality, economy, reliability and purposefulness of the financing of healthcare services.
4. AOTMiT, on the minister’s commission, carries out analytical work related to these purposes and hands the results to the minister (Article 31n point 4h and Article 31o(2) point 1n of the Act on healthcare services).

The act does not specify when the minister is to make the first request, how often the minister is to do so, or by what key facilities are selected.¹ Nor does it provide for a regulation setting the scope and format of the data, so that too is determined by the request itself. Article 31lc is different: there the rules for handing data over to AOTMiT are set by the President of the Agency and published in the Public Information Bulletin (BIP) (paragraph 4c).⁶

The act does not specify how long the data are kept. The data protection impact assessment assumes that the data will go to AOTMiT’s servers and will be processed after pseudonymisation, and kept for no longer than 5 years. After that time it is to be checked whether there is a basis for further processing.²

Three limitations

Only on request

Without the minister’s request a facility does not have to collect or hand over anything, and the act provides for no regular cycle.¹ Nor does it provide for the publication of requests or of a list of their addressees. From outside, therefore, one cannot see which facilities the minister asked and which not.

No publication

None of the purposes listed in paragraph 2 concerns informing citizens, and the results of AOTMiT’s analyses go to the minister.¹ The data protection impact assessment states plainly that recipients do not publish data from the system, and that they may be made available only to the minister, at the minister’s request.²

No sanctions

The Act on medical activity provides for financial penalties in three places: for a manager who temporarily suspends in-patient activity without following the procedure (Article 35), for failing to report changes in data covered by the register (Article 107(2)) and for trading in medicinal products contrary to the prohibitions of the Pharmaceutical Law (Article 111a(2)). None of them concerns Article 27a.⁸ The amendment did not add a new penalty.¹ The minister may inspect healthcare providers for compliance with the law (Article 118), but the act provides for no penalty for failing to hand over the data.⁸

Two provisions, two wordings

Alongside Article 27a there is a second, older obligation: Article 31lc(4a) of the Act on healthcare services. It was in force before the amendment. The June act removed anonymisation from the data it covers, added the PESEL and PWZ numbers to them, and widened the purposes for which AOTMiT may use them (paragraph 4d).⁶¹ The two provisions describe similar data in different words.

The difference in wording raises questions that the act does not settle: whether “persons employed” in Article 27a include doctors under contracts, whether the obligation extends to a person when the party to the contract with the facility is that person’s company, and how to enter “working time” for someone who is not an employee. The Act on medical activity itself does not use this word consistently. Article 36 distinguishes employed persons from those in a civil-law relationship, while Article 92 calls academic teachers of medical universities working under a civil-law contract employed persons as well.⁸

The explanatory memorandum to the bill, however, points to a broad intention: alongside employment contracts it lists civil-law contracts and contracts with doctors, and the data protection impact assessment lists contracts of mandate, contracts for specific work and contracts with doctors.² That is why we write about inconsistent wording rather than a gap. How far Article 27a reaches will be shown by the practice of the minister’s requests or by case law.

Reactions

The bill did not go through pre-consultation. The government sent it to the Sejm without inter-ministerial agreement, public consultation or opinions, citing urgent need.²

Nor was the bill sent to the President of the Personal Data Protection Office (UODO) for an opinion. This was said on 26 June 2026 to the news site Forsal.pl by the office’s deputy press spokesperson. He added that the legislator must demonstrate that the solution is proportionate, and that processing information about the pay of specific people carries a risk of profiling them.⁹ This is a statement to the media, not a formal position of the President of the UODO.

The President of the Supreme Medical Council announced that if the president did not veto the act, the medical self-government would challenge it before the Constitutional Tribunal.¹⁰ As of the date this analysis was updated, we had found no confirmation that an application to the Tribunal had been filed.

The president signed the act on 17 July 2026. In a statement he admitted that it had been drafted in haste and without sufficient consultation. He judged, however, that leaving the system without control mechanisms would be a greater threat, and announced that he would monitor the effects of the provisions and, if necessary, seek additional safeguards for staff data.¹⁰

What follows from this

The act solves one problem we write about: the state can now collect data from which one person’s payments can be added up, because it links them with the PESEL number and the number of the licence to practise. It does not solve the second. Nobody outside the administration will see these totals.

Our demand concerns exactly this step: publishing the total paid to each person from public money, under a permanent identifier, without names. We describe it on the page of our demand, and how to add it to Article 27a is shown in our draft act (in Polish).

Notes 10laws, data and statements we relied on

1. Act of 19 June 2026 amending the Act on publicly funded healthcare services and the Act on medical activity (in Polish; Dz.U. 2026 item 972) — Article 1 (Articles 31lc, 31n and 31o of the Act on healthcare services), Article 2 (new wording of Article 27a of the Act on medical activity), Article 3 (entry into force). ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹

2. Government bill, print no. 2685 (in Polish), 16.06.2026 — explanatory memorandum, regulatory impact assessment (point 4: about 18,042 healthcare providers; point 5: no pre-consultation, and inter-ministerial agreement, consultation and opinions omitted) and data protection impact assessment (method of handing over and pseudonymisation, no publication, retention period, purpose: the total earnings of a person employed in several entities). ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

3. Chancellery of the Sejm, record of the act Dz.U. 2026 item 972 in the ELI system (in Polish) — published 21.07.2026, in force from 5.08.2026. ↩ ↩²

4. Sejm of the Republic of Poland, course of legislative process no. 2685 (in Polish) — bill received 16.06.2026, vote on 19.06.2026 (253 in favour, 0 against, 177 abstentions), Senate without amendments 25.06.2026, signed by the president 17.07.2026. ↩

5. Act on medical activity (in Polish; consolidated text Dz.U. 2026 item 156), Article 27a — wording before the amendment. ↩ ↩² ↩³

6. Act on publicly funded healthcare services (in Polish; consolidated text Dz.U. 2025 item 1461), Article 31lc(2) and (4a)–(4d) — wording before the amendment. ↩ ↩² ↩³

7. Labour Code (in Polish; consolidated text Dz.U. 2025 item 277), Article 130 § 1 — the working time applicable to an employee, calculated from the daily and weekly standards. ↩

8. Act on medical activity (in Polish), unified text prepared by the Chancellery of the Sejm taking into account Dz.U. 2026 items 156 and 972 — Article 2(1)(5) and Article 4(1) (who performs medical activity), Articles 35, 107(2) and 111a(2) (financial penalties), Articles 36 and 92 (employed persons), Article 96 (the repealing provision enters into force on 1.01.2028, Dz.U. 2018 item 1532), Article 118 (inspection by the minister). ↩ ↩² ↩³ ↩⁴ ↩⁵

9. Forsal.pl, “Zarobki lekarzy pod lupą. UODO ostrzega: informacje o wynagrodzeniach konkretnych osób będą wiązać się z ryzykiem ich profilowania” (“Doctors’ earnings under scrutiny. UODO warns: information on the pay of specific people will carry a risk of profiling them”, in Polish), 26.06.2026. ↩

10. Infor.pl (citing PAP), “Wynagrodzenia lekarzy pod lupą. Jest podpis prezydenta” (“Doctors’ pay under scrutiny. The president has signed”, in Polish), 17.07.2026. ↩ ↩²