DPA case DKE.523.10.2021 – Dismissed (Poland, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A bank in Poland processed a customer's personal data for credit assessments, even after the customer had fulfilled their obligations. This case matters because it raises questions about how long companies can keep using personal data.
What happened
The bank processed the customer's personal data without consent after their credit obligations ended.
Who was affected
The customer whose personal data was used by the bank for credit assessments.
What the authority found
The data protection authority did not find a violation but acknowledged the complexities of data processing after obligations are fulfilled.
Why this matters
This case highlights the need for businesses to be clear about how long they retain and use personal data. Companies should establish clear policies on data usage to avoid potential issues.
View original scraped data
Original imported citations before automated processing; the processing history does not establish independent verification.
Source checks
Secondary-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: articles corrected, national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
The Bank obtained the Complainant's personal data in connection with the conclusion of an agreement between the aforementioned parties, for the purposes of creditworthiness assessment and risk analysis. The processing of personal data took place even before the entry into force of the GDPR, as it was necessary for the exercise of a right or fulfilment of an obligation arising from a legal provision. After the entry into force of the GDPR, the processing of the applicant's personal data by the bank took place on the basis of Article 6 (1)(b) GDPR and Article 6 (1)(c) GDPR. The Bank transferred the Complainant's personal data to the entity keeping the register of liabilities, on the basis of the Complainant's consent, in accordance with the provisions of the Banking Law. The Bank processed the Complainant's personal data in the credit information bureau for the purposes of creditworthiness assessment and credit risk analysis. In view of the Complainant's failure to meet his obligations under the agreements concluded by the Complainant with the bank on time, the Complainant's personal data were also processed without his consent after the expiry of the obligation in question. The Bank - in accordance with its explanations submitted in these proceedings - indicated that it is currently processing the Complainant's personal data resulting from the aforementioned agreement on the basis of Article 6 (1)(f) GDPR, for the purposes related to the assertion of claims and defence against possible claims related to the performance of agreements concluded by the Complainant with the Bank. The Complainant argued that the Bank had no legal basis for processing his personal data without the complainant's consent, as the Bank had not lawfully informed him of its intention to process his personal data, which constituted bank secrets, after the expiry of credit obligations without his consent. The President of the Office for Personal Data Protection refused to grant the request to or
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case DKE.523.10.2021 in PL
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case DKE.523.10.2021 - Poland (2021). Retrieved from cookiefines.eu
Last updated: