The Supreme Administrative Court (NSA) in its ruling of February 13, 2025, confirmed that banks cannot process personal data of loan applicants if a contract was not finally concluded. The court dismissed the cassation complaint of Alior Bank and the Credit Information Bureau (BIK), thus upholding the decision of the President of the Personal Data Protection Office (UODO) and the judgment of the Provincial Administrative Court (WSA) in Warsaw.
Consequences for banks and the Credit Information Bureau
The NSA’s decision means that banks and institutions collecting credit data cannot process information about people who applied for a loan but ultimately did not sign a contract. This is a significant ruling in the context of personal data protection and compliance with GDPR.
The President of UODO found that since a loan agreement was not concluded, the bank and BIK have no legal basis for further processing of personal data. The supervisory body issued a decision ordering the cessation of processing such information after conducting proceedings that were initiated as a result of a customer complaint.
The bank’s argumentation and the court’s position
Alior Bank and BIK argued that they can process personal data based on:
- Art. 6 sec. 1 lit. f GDPR (legitimate interest of the controller),
- Art. 105a of the Banking Act, which defines the rules for collecting and processing data for credit assessment and credit risk management.
However, courts of both instances did not share this argumentation. The WSA found that the bank cannot invoke these provisions in a situation where a loan agreement was not concluded. In his opinion, further processing of data of a person who did not receive a loan is unjustified and violates personal data protection regulations.
The NSA, considering the cassation complaint, upheld the position of the WSA and the decision of the President of UODO, which means a final settlement of the case to the disadvantage of the bank and BIK.
This ruling has significant consequences for the banking sector and the Credit Information Bureau. Banks will have to change their practices regarding the storage and processing of potential customers’ data. Applicants who did not receive a loan, on the other hand, gained stronger protection of their personal data.
The case records:
- WSA: II SA/Wa 1982/20
- NSA: III OSK 6563/21
- President of UODO’s decision: ZSPR.440.1522.2018
Disclaimer: The information contained in this publication is for informational purposes only. It does not constitute financial or any other advice, is general in nature and is not directed at a specific recipient. Before using the information for any purposes, independent advice should be sought.
Source: https://managerplus.pl/nsa-bank-nie-moze-przetwarzac-danych-wnioskodawcy-jesli-nie-doszlo-do-zawarcia-umowy-kredytowej-83022
