The RODO certificate and the principle of fair competition in tenders

The entry into force of the GDPR is not without significance for the requirements imposed on contractors in tenders. One of the issues of controversy concerns the so-called the RODO certificate.

RODO certificates are certificates confirming compliance of existing personal data processing systems in the enterprise with the RODO Regulation. Such certificates are issued by the President of the Office of Personal Data Protection and private companies that are accredited by the Polish Center for Accreditation.

The basic doubt that may arise in relation to the above-mentioned certificate is the possibility indicated in the ToR with the obligation to have the RODO certificate as one of the conditions for participation in the procurement procedure. Due to the fact that obtaining such a certificate requires additional financial expenditures and not all contractors have this document, formulating such a condition could create unequal opportunities for contractors.

The Ministry of Digitization initially took the position that the possession of the certificate would not be mandatory, and only it could be additionally scored by the awarding entities in tenders. It should not, therefore, result in exclusion from the proceedings.

However, the Public Procurement Office adopted a different position. At the beginning of February 2018, the Office stated that the current public procurement law rules allow the Contractor to be excluded from the tender due to the lack of the GDPR certificate, justifying it in so doing, that the contracting party specifies the conditions for participation in the proceedings and the required documents in a manner proportional to the subject of the contract and enabling assessment of the contractor’s ability to properly perform the contract. In particular, it may require Contractors to have the certificate referred to above. Therefore, if the contractor fails to demonstrate compliance with such a condition, the orderer will be able to exclude him from the tender in accordance with art. 24 sec. 1 point 12 of the Public Procurement Law.

Currently, the Public Procurement Office slightly softened the above-presented approach, but it still did not clearly determine when the contracting authority would be able to indicate the possession of the RODO certificate as one of the conditions for participation in the proceedings. The PPO stated only vaguely that (…) if the subject of the contract does not apply to the GDPR, the condition of participation in the procedure relating to the contractors’ obligation to perform the personal data processing of these contractors, in the light of the above-mentioned standards, the RDC seems excessive, inconsistent with art. 22 of the Public Procurement Law and may constitute an obstacle to access to the contract and restrict competition, especially in the context of access to this procedure of small and medium-sized enterprises. “(Office of Public Procurement Office of February 15, 2018).