Poland backs narrower tax access to bank-account data

Poland’s Personal Data Protection Office has backed a parliamentary bill that would narrow the National Revenue Administration’s access to bank-account data and require court consent for requests concerning other individuals.

The Sejm’s Public Finance Committee considered the proposal on 16 September. It would change the framework associated with Article 48 of the National Revenue Administration Act, while placing the amendment in the Banking Law rather than directly in the KAS Act.

From committee consideration to a narrower access test

Under the current rules described by UODO, KAS can request extensive information from banks, including dates and amounts of credits and debits, transfer counterparties and loan and credit data. The proposed change would permit direct access to accounts held by a person with suspect status. Requests concerning other individuals would require court consent.

The committee’s consideration is the latest identified stage in the Sejm parliamentary process. UODO’s notice says further parliamentary work will determine the final form of the provisions. Its support is an institutional position on a parliamentary proposal, not a final legislative outcome or an enforcement action.

The proposal reflects concerns raised by UODO President Mirosław Wróblewski in correspondence with the Finance Ministry and the Chancellery of the Sejm. In July 2024, he asked Finance Minister Andrzej Domański to align the KAS Act with the Polish Constitution, the GDPR and international case law. UODO later identified Articles 46a and 48 as provisions that, in its view, contained mechanisms disproportionately interfering with privacy and personal-data protection.

The notice also records separate concerns about analytical processing and special-category data. Wróblewski said data collected by KAS for specific purposes should not be combined with other data or used for purposes not provided for in law, including analytical purposes. UODO’s position was that analytical processing should use anonymised data and that this should be reflected in legislation.

Those issues should not be treated as resolved by the bank-data proposal. The notice says Wróblewski sought further clarification of Article 46a, which concerns information exchange between the Minister of Health and KAS authorities, including safeguards for data such as health information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, sexuality or sexual orientation. It does not establish that the present bill settles those questions.

The immediate decision point is therefore procedural. Until enacted text and an effective date exist, KAS requests for bank information remain governed by the current statutory framework; the proposed suspect-status and court-consent conditions are not yet operative.

UODO’s notice identifies no scheduled next parliamentary event and no commencement date. Readers should monitor the parliamentary file and any subsequent binding text.