The Act on the National Revenue Administration requires amendments

The President of the Personal Data Protection Office has appealed to the Minister of Finance, Andrzej Domański, to align the provisions of the Act on the National Revenue Administration (KAS) with the requirements arising from the Constitution of the Republic of Poland, Regulation 2016/679, and international courts rulings.

KAS carries out tasks related to the collection of taxes, fees, and customs duties. It deals with detecting crimes in this area, and conducts analytical, predictive, and research activities. For these purposes, it uses data collected by KAS authorities in registers, databases, records, and filing systems.

According to Article 47 of the Act on KAS, the bodies of the National Revenue Administration have the right to process special categories of personal data, including data concerning criminal convictions and offenses or related security measures. The President of the Polish SA notes that such a broad scope of competencies and their implementation using personal data, also in an automated manner, including profiling, involves the potential for many privacy and data protection risks.

Personal data collected by KAS for specific purposes should not be combined with other data and used for purposes not provided for by law (e.g., analytical purposes), as this is contrary to the provisions of the GDPR.

As a rule, the structure of KAS as a whole cannot be regarded as a special service, and its broad competencies in the field of personal data processing and operational activities towards citizens cannot be justified by national security.

The competencies of tax authorities provided for by the Act on KAS raise doubts in the context of Article 51 of the Constitution of the Republic of Poland, which ensures the right to the protection of personal data. In particular, it concerns the balance between the actions of state authorities and the rights of citizens. In light of Article 51(2) of the Constitution of the Republic of Poland, public authorities shall not acquire, collect nor make accessible information on citizens other than that which is necessary in a democratic state ruled by law.

The President of the Polish SA has particular reservations about Articles 46a and 48 of the mentioned Act, as they contain mechanisms that disproportionately interfere with the privacy of individuals and the right to personal data protection. Therefore, it is crucial to initiate a discussion on the current model of personal data processing by the bodies of the National Revenue Administration.

According to the President of the Polish SA, Article 46a of the Act on KAS needs to be further specified (due to the lack of adherence to the transparency and fairness principles of the GDPR), to explicitly exclude the transfer of personal data that may disclose the health status of identified individuals. Article 48 of the Act on KAS requires urgent and thorough amendment because it violates the principle of legality and is inconsistent with the principles of proportionality and purpose limitation of the GDPR. This provision gives KAS the authority to obtain detailed information concerning specific bank accounts.

The Act on the National Revenue Administration requires a comprehensive review in terms of solutions to ensure the protection of personal data processed under its provisions, as well as regulations ensuring the application of the GDPR - states the President of the Polish SA.

The President of the Polish SA’s appeal to the Minister of Finance is available in Polish the attached file.