The dispute over the explanation of Article 105a(3) of the banking law is over. It was a question of the right to process bank secret data that concerns those who are behind their obligations to the bank after the contract has expired. The determination required erstwhile a bank (financial institution) could respond and process the data of that individual without its consent in the BIK (Credit Information Office).
Data processing in BIK
Banks may process information constituting a banking secret concerning natural persons after the expiry of the work under the agreement concluded with the bank, without the consent of the individual concerned. This is possible under Article 105a(3) of the Act where specified a person:
- has not fulfilled the work or has committed a hold of more than 60 days in the performance of the benefit resulting from the contract concluded with the bank, and
- after the occurrence of those circumstances, at least 30 days have elapsed since the bank informed the individual of its intention to process specified information without its consent.
Consequently, the Bank has the right to process data in the Credit Information Office for a period of 5 years after the expiry of the obligation. Previously, however, the bank:
- After the hold has occurred, it must inform the data subject that it intends to process his or her data without his or her consent and inform him or her of the intent of the processing,
- 30 days must elapse from that moment; at that time, the bank's erstwhile client can pay back the backlog – then the bank will not be able to process its data covered by bank secrecy.
Position of the president of the Office for individual Data Protection
According to the president of UODO, it is the work of the bank to show that the 30-day period has already expired. The bank must prove that it has informed the erstwhile client of its intention to process his data without his consent and must show that he has fulfilled to the client the work set out in Article 105a(3) of banking law – i.e. that he effectively informed about the intention to process information relating to him which is simply a bank secret without his consent after the expiry of the contractual obligation.
Important! According to the position of the president of UODO, I am simply late with the performance of the work for at least 60 days does not authorise the bank to process individual data under the conditions laid down in Article 105a(3) of banking law. The additional 30 days must pass, and this deadline does not run automatically, but only from the minute erstwhile the consumer is effectively informed of the intention to process his data.
According to, inter alia, the judgmentChief Administrative Court of 17 December 2024 in Case III OSK 1428/24: Although the legislator has not defined or created any circumstantial formal requirements in Article 105a(3) of the Act, there is no full freedom.
Legal basis:
Read more:
The bank cannot freely process the data of its debtor
