The Supreme Administrative Court upheld the decision of the President of the PL SA

The Supreme Administrative Court upheld the decision of the President of the Personal Data Protection Office concerning the processing of prospective bank customers' data.

Banks and the Credit Information Bureau may not process the data of individuals who have applied for credit but ultimately did not enter into a contract. Credit checks authorise the processing of data, but only during the process, not afterwards.

The Supreme Administrative Court upheld the position of the President of the Personal Data Protection Office in two cases (III OSK 1552/22 and III OSK 1877/22). The first case concerned a prospective customer of SKOK Stefczyka Bank, and the second concerned a prospective customer of Alior Bank. Both financial institutions checked the data in the loan applications at the Credit Information Bureau, and when the agreements were not concluded, they refused to delete the data of the prospective customers.

The President of the Personal Data Protection Office argued that if the agreement was not concluded, there were no longer any grounds for processing the data. SKOK Stefczyka Bank, Alior Bank, and Credit Information Bureau, in appealing against the decision of the President of the Personal Data Protection Office, pointed out that they had the right to process the data.

Alior Bank invoked Article 70 of the Polish Banking Law and its right to collect data from Credit Information Bureau on the basis of Article 105(4) and Article 105a(1) of the Banking Law. However, the Supreme Administrative Court noted that these provisions refer to the processing of data before the obligation arises, during its duration, and after its expiry. When no credit agreement is concluded, there are no grounds for legalising the further processing of the credit applicant's data. Such grounds cannot be inferred from Article 70a(1)-(2) of the Polish Banking Law either.

In the SKOK Stefczyka Bank case, the Supreme Administrative Court noted that all regulations abolishing personal data protection must be interpreted and applied strictly, taking into account the function they are intended to serve. When granting credit, financial institutions have a legal basis for processing data. This is because they must assess creditworthiness. However, if no credit agreement is concluded following the submission of a credit application, there are no legal grounds for further processing of personal data.

The second argument raised in these cases in favour of the right to process personal data was, according to the complainants, the decision of the President of the Personal Data Protection Office under Article 6(1)(f) of the GDPR, i.e. the legitimate interest pursued by the data controller, which is the possible pursuit of claims arising in connection with the performance of banking activities and other activities resulting from generally applicable regulations.

However, as pointed out by the President of the Personal Data Protection Office and confirmed by the Supreme Administrative Court, the premise of Article 6(1)(f) of the GDPR applies to situations that already exist, not to situations where data is processed for the purpose of protecting against potential claims.

In the opinion of the Supreme Administrative Court, under the GDPR, it is unacceptable – if no credit agreement has been concluded – to continue processing the applicant's personal data “for the future” for purposes completely different from those for which it was collected, if no clear legal basis for such actions can be reconstructed.

If we were to agree with the position presented in Credit Information Bureau's cassation complaint, that obtaining data at the stage of submitting a loan application entitles SKOK Stefczyka Bank to further (rather long) storage after the refusal to conclude a loan agreement (for the purpose of building scoring models, i.e., tools used by banks to assess creditworthiness and analyse credit risk for a period of 5 years from the date of the inquiry, and for statistical and analytical purposes for a period of 10 years from the date of submitting the query to Credit Information Bureau, or even 12 years), the regulations contained in Article 105a of the Polish Banking Law limiting the time of processing customer data from loan agreements would be deprived of legal value and effectiveness.

III OSK 1552/22, DS.523.541.2020

III OSK 1877/22, DS.523.1166.2020