Supreme Administrative Court agrees with the position of the President of the Personal Data Protection Office concerning individuals conducting business activities
On 2 September 2026, the Supreme Administrative Court (NSA) (III OSK 252/24) dismissed the cassation appeals lodged by PKO BP S.A. and the Credit Information Bureau against a decision of the President of the Personal Data Protection Office. The appeals concerned the interpretation of the term “natural person”, as used, among other provisions, in Article 105a(2) and (3) of the Banking Law. The case concerned the processing of information relating to natural persons conducting business activities. Until now, the banking sector had taken the position that Article 105a(2) and (3) of the Banking Law applied exclusively to consumers and that, consequently, the rules set out in these provisions did not apply to natural persons conducting business activities. Entrepreneurs who are natural persons were therefore unable to effectively rely on these provisions in disputes concerning the processing of their personal data by banks and financial institutions.
Pursuant to Article 105a(2) of the Banking Law, personal data may be processed after an obligation has expired if the consent of the natural person has been obtained. Article 105a(3) of the Banking Law, on the other hand, provides that personal data may be processed without the person’s consent if they have failed to fulfil an obligation towards a bank or have been in arrears for more than 60 days. Consequently, if such a person has been informed of the intention to process their data without their consent and 30 days have elapsed from the effective notification of that intention, banks and financial institutions may process their personal data without their consent, including by sharing information about arrears in the repayment of financial obligations, for example through entries in the Credit Information Bureau. Where the conditions set out in these provisions are met, the debtor’s personal data may be processed without their consent for up to five years after the obligation has expired.
Until now, the provisions governing the conditions for processing personal data had been interpreted as applying to consumers, but not to natural persons who had entered into a relationship with, for example, a bank in connection with conducting business activities.
The Supreme Administrative Court’s judgment dispels these doubts and makes a significant contribution to the interpretation of the provisions of the Banking Law. Article 105a(2) and (3) of the Banking Law also applies to natural persons conducting business activities. In doing so, the Supreme Administrative Court agreed with the position of the President of the Personal Data Protection Office that the provisions referred to above have a broader scope of application and do not apply exclusively to natural persons acting as consumers.
We discussed other possibilities for a bank to process the data of a former customer in a commentary dated 13 March 2025, which is available here.