The Supreme Administrative Court confirmed that a bank may not process the data

The Supreme Administrative Court confirmed that a bank may not process the data of a person who has been refused credit

An applicant's data for a loan cannot be processed if the customer's contract with the bank has not been concluded, the Supreme Administrative Court confirmed in a judgment of 13 February 2025.

The Supreme Administrative Court dismissed the cassation appeal of Alior Bank and the Credit Information Bureau against the judgment of the Voivodeship Administrative Court in Warsaw, which upheld the decision of the President of the Personal Data Protection Office ordering the bank to cease processing the data of a would-be customer. The courts therefore agreed with the President of the Personal Data Protection Office that the processing of data in the field of creditworthiness assessment and credit risk analysis, related to enquiries that did not result in the granting of a loan, could not be applied in connection with Article 6(1)(f) of the GDPR (legitimate interest of the controller) and Article 105a of the Banking Law. And these were the grounds cited by the complainants.

This case was related to a decision of the President of the Personal Data Protection Office issued after a proceedings initiated following a complaint from a person who applied for a loan from the bank but did not get it. Despite this, the bank continued to process his or her personal data, obtained for the purposes of creditworthiness and credit risk assessment. However, the supervisory authority considered that, since no credit agreement had been concluded, both the bank and the Credit Information Bureau had no grounds to continue processing the person's data.

Both institutions decided to appeal the decision of the President of the Personal Data Protection Office to the Voivodeship Administrative Court. However, this court agreed with the supervisory authority and confirmed its argumentation regarding the lack of legal grounds for data processing in this case.

This judgment went to the Supreme Administrative Court, which dismissed the Bank's and Credit Information Bureau’s cassation appeals and upheld the judgment of the Voivodeship Administrative Court and thus the decision of the President of the Personal Data Protection Office.