Since no contract has taken place, data cannot be further processed

Since no contract has taken place, data cannot be further processed

The Supreme Administrative Court on 29 May 2025 overturned the judgment of the Voivodeship Administrative Court in Warsaw of 29 October 2021 and dismissed the complaint of the Credit Information Bureau against the decision of the President of the Personal Data Protection Office of 15 December 2020. In it, the President of the Personal Data Protection Office ordered the bank and the Credit Information Bureau to cease processing the personal data of the would-be customer to the extent resulting from the credit enquiry.

The decision of the President of the Personal Data Protection Office was issued following a procedure initiated following a complaint from a person who had applied for a loan from the bank, but ultimately the agreement was not concluded. Despite this, the bank and the Credit Information Bureau continued to process his or her personal data, obtained for the purpose of assessing creditworthiness and credit risk assessment. The supervisory authority concluded that, since no credit agreement was concluded, both the bank and the Credit Information Bureau had no grounds to continue processing the person's data.

The Credit Information Bureau appealed the decision of the President of the Personal Data Protection Office, and the Voivodeship Administrative Court in Warsaw agreed with it, finding that the basis for the processing of the indicated data at Credit Information Bureau is Article 6(1)(c) of GDPR in connection with Article 105(4) and Article 105a(1)-(1c) of the Banking Law and Article 6(1)(f) of GDPR in connection with Article 118 of the Civil Code.

This judgment was appealed by the President of Personal Data Protection Office to the Supreme Administrative Court, which overturned the Voivodeship Administrative Court's judgment and dismissed Credit Information Bureau's complaint, thereby adhering to the position expressed in the supervisory authority's decision of 15 December 2020.

The Supreme Administrative Court agreed with the President of the Personal Data Protection Office that the processing of data in the field of creditworthiness assessment and credit risk analysis, related to enquiries that did not result in the granting of a loan, cannot take place for the purpose of building so-called scoring models. These are tools used by banks and other lending institutions for creditworthiness assessment and credit risk analysis, for statistical and analytical purposes and for the handling of possible complaints and compensation claims. The indicated institutions refer to Article 6(1)(f) of the GDPR, i.e. the controller's legitimate interest, as the basis for carrying out such data protection analyses.

This is yet another case in which the Supreme Administrative Court has confirmed the position of the President of the Personal Data Protection Office on the processing of data of a would-be bank customer. We reported on one such case in a communication on the website: https://www.uodo.gov.pl/en/553/1859.