Court case II SA/Wa 607/20 – Court Ruling (Poland, 2021)

Individuals have complained to the Polish supervisory authority about the processing of their personal data by their bank without a legal basis and for marketing purposes. The applicants were customers of the bank and held personal and savings accounts with it. After some time, the customers requested the bank in writing to stop sending advertising material and bank statements to their address and withdrew their consent to the processing of their personal data by the bank, which withdrawal of consent included the quote: "the use, processing and archiving of all our personal data by the Bank". The bank informed the applicants that it would not comply with the request due to the impossibility of confirming the identity of the applicants, and also indicated the possibility of submitting the request in person at any bank office or by sending a request to that effect via the bank's helpline or Internet channel. The applicants have refused to use the communication channels indicated to them by the bank and have renewed their statement withdrawing their consent to the processing of their personal data by the bank. The bank eventually closed the customers' bank accounts and at the end sent them a monthly bank statement and later a combined bank statement, which contained information about the bank's subscription to a new structured deposit. By letter from November 2018 the bank stated that it currently processes the applicants' data in terms of first names, surnames, type of identity document, identity document number, expiry date of identity document, country of issue of identity document, PESEL identification number, date of birth, place of birth, country of birth, residence status, nationality, parents' first names, marital status, mother's maiden name, gender, residential address, correspondence address, mobile phone number, home phone number, form of employment and preferred language of contact, data on the bank's products held, CIF number (identification number assigned to the bank's customers), on the basis of Article 6(1)(f) GDPR, i.e. in the legitimate interest pursued by the bank, for the purpose of establishing, investigating or defending against possible claims by applicants. The DPA pointed out that, as of the date of closure of the clients' bank accounts, the bank should cease processing their personal data in connection with the contracts between it and the applicants, i.e. on the basis of Article 6(1)(b) GDPR. However, pursuant to Article 17(3)(e) GDPR, the right to request from the controller the immediate erasure of personal data concerning the data subject, pursuant to which the controller is obliged to erase personal data without undue delay, does not apply to the extent that the processing is necessary for the establishment, assertion or defence of claims. In the opinion of the DPA, the evidence gathered in the present proceedings has not demonstrated that the applicants have made any claim against the bank that would justify the bank's right to retain and process their personal data for evidential purposes in connection with the applicants' pursuit of this claim. The DPA issued a decision ordering the bank to delete the applicants' personal data and issued a warning to the bank for violating Articles 6(1), 12(2) and (3), and 21(3) GDPR. The administrative court dismissed the bank's appeal against the supervisory authority's decision. It indicated that it did not appear from the evidence gathered in the course of the proceedings that the applicants had made any claim against the bank which would entitle the bank to retain and process their personal data for evidential purposes in connection with their pursuit of that claim. The court emphasised that the premise of Article 6(1)(f) GDPR relates to an already existing situation where the purpose deriving from the legitimate interests pursued by the controller is the need to prove, or the need to assert or defend against, an existing claim, not to a situation where the data are processed in order to safeguard against a possible claim. Therefore, it is not permissible to process personal data as if "in advance" with the assumption that they may possibly be useful in the future and with reference to the provisions concerning the limitation of civil law claims.