Fighting discrimination against oncology patients in access to financial services

The President of the Personal Data Protection Office, Mirosław Wróblewski, has appealed to the Minister of Finance and Economy, Andrzej Domański, calling for legislative action to guarantee cancer patients who have completed treatment the right to be forgotten in the financial sector. People who have survived cancer still face discrimination when concluding loan and insurance contracts.

The right to be forgotten is guaranteed under Article 17 of the General Data Protection Regulation (GDPR) and Article 51(4) of the Polish Constitution. In practice, it means the possibility of having personal data erased once it is no longer needed for the purposes for which it was collected.

With regard to a past cancer diagnosis, oncology patients currently have no way to exercise their right to be forgotten in the broadly understood area of financial services.

Today, the issue of how banks and insurers use personal data containing information about past cancer diagnoses is becoming especially significant. Currently, financial service providers may (for the purpose of assessing creditworthiness and insurance risk) obtain oncology patients' medical data with practically no time limits. In the supervisory authority's assessment, this leads to a situation where people cured of cancer bear higher insurance costs for many years or face difficulties accessing credit. Importantly, the European Parliament has noted that cancer patients should not face a "double penalty" after finishing treatment. Many other countries — including France, Belgium, and Luxembourg — already have mechanisms in the financial sector that guarantee effective enforcement of the right to be forgotten.

In its resolution on strengthening Europe's fight against cancer, the European Parliament called on member states to guarantee, by 2025 at the latest, that all European cancer patients have the right to be forgotten. It was established that information about a cancer diagnosis should not be used after 10 years from the end of treatment, or after five years for people diagnosed before turning 18. This is meant to help prevent discrimination in equal access to financial services.

Directive 2023/2225 on consumer credit agreements was adopted in response to the European Parliament's expectations. Under its provisions, member states are required to introduce national rules preventing the use of personal data — including cancer diagnoses — for concluding insurance policies linked to credit agreements. The maximum period for processing such data may not exceed 15 years from the end of treatment.

In Poland, the directive is to be implemented through the Consumer Credit Act. The draft amendment provides that personal data concerning cancer diagnoses may not be obtained or used for the purpose of concluding loan repayment insurance contracts after five years from the end of treatment.

While the adoption of these provisions will realize the right to be forgotten for patients with respect to this type of contract, it should be noted that they cover only a fragment of the financial services offered to oncology patients.

Current regulations lack provisions guaranteeing that consumers' personal data concerning cancer diagnoses will not be obtained or used for concluding an insurance contract after treatment has ended. Under the Patient Rights Act and the Insurance and Reinsurance Activity Act, medical records may be shared with insurers with the patient's consent.

The President of the Personal Data Protection Office added that, in line with the principle of data minimization, personal data may only be processed to the extent necessary and for the period required to achieve a specific purpose. The lack of clear time limits raises serious concerns from the standpoint of respecting fundamental rights.

It is therefore essential to take appropriate action to ensure that oncology patients have an effective right to be forgotten across the broadly understood area of financial services — for example, following the model of the regulations currently being drafted for its narrow segment, namely consumer credit agreements.