The tax authorities versus citizens’ privacy. A parliamentary bill in line with the recommendations of the President of the Personal Data Protection Office

“At present, the tax authorities have too much leeway in monitoring bank accounts, which constitutes a departure from the principle of banking secrecy and a significant encroachment on citizens’ right to privacy,” reads the explanatory memorandum to the draft amendment aimed at restricting the powers of the National Revenue Administration. The need for such regulations had previously been advocated by the President of the Personal Data Protection Office (UODO), Mirosław Wróblewski.

Under the current legislation, the National Revenue Administration (KAS) may request a wide range of information from banks, such as the dates and amounts of incoming and outgoing payments, the senders and recipients of transfers, and details of loans and credits, etc. However, this is set to change.

It will not be possible without court authorisation

On 16 September, the Sejm’s Public Finance Committee considered a draft amendment which provides for a change to Article 48 of the Act on the National Revenue Administration. The crux of the matter is that tax authorities will only be able to obtain data from the bank accounts of those persons who have the status of a suspect. In any other case, this will only be possible with the court’s consent. According to the draft bill, this amendment is to be included not in the Act on the National Tax Administration, but in the Banking Act.

The final form of the legislation will be determined by further parliamentary work, but the draft has already incorporated many of the comments raised by the President of the Personal Data Protection Office (UODO) over two years ago.

The GDPR, the Constitution and risks

In July 2024, the President of the Personal Data Protection Office (UODO), Mirosław Wróblewski, wrote to the Minister of Finance, Andrzej Domański, requesting that the provisions of the Act on the National Revenue Administration be brought into line with the requirements of the Polish Constitution, Regulation (EU) 2016/679 and the case law of international courts (more: News – UODO).

“In accordance with Article 47 of the Act on the National Revenue Administration, the authorities of the National Revenue Administration are entitled to process special categories of personal data, including data relating to criminal convictions, offences or associated security measures. Such a broad scope of powers and their exercise using personal data, including by automated means such as profiling, entails the potential for numerous risks to privacy and the protection of personal data” – noted the President of the Personal Data Protection Office (UODO), emphasising that “Personal data collected by the National Revenue Administration (KAS) for specific purposes should not be combined with other data or used for purposes not provided for by law (e.g. analytical purposes), as this contravenes the provisions of the GDPR”.

The President of the Personal Data Protection Office (UODO) has particular reservations about the provisions of Articles 46a and 48 of the aforementioned Act, as they contain mechanisms that disproportionately interfere with an individual’s privacy and the right to the protection of personal data. “For this reason, it is also extremely important to initiate a discussion on the current model of personal data processing by the National Revenue Administration,” emphasised Mirosław Wróblewski at the time.

Disproportionate interference with privacy

In August 2024, in a letter to Dariusz Salamończyk, Deputy Head of the Chancellery of the Sejm of the Republic of Poland, the President of the Office for Personal Data Protection (UOOD) submitted comments on a parliamentary draft amendment to the Act on the National Revenue Administration. On that occasion, he pointed out that Articles 46a and 48 of the Act on the National Tax Administration, as currently worded, still contain mechanisms that disproportionately interfere with an individual’s privacy and the right to the protection of personal data, as guaranteed by the Constitution of the Republic of Poland and European law.

“The MPs’ bill proposes amending Article 48 of this Act so that the information provided by banks under this provision would include details of the bank accounts of a person suspected of a criminal offence, rather than those of any natural person. And this is a step in the right direction, as it responds to the proposals put forward by the supervisory authority in its submission to the Ministry of Finance,” emphasised Mirosław Wróblewski, adding that there is a need for a more comprehensive review of the regulations contained in the Act on the National Revenue Administration concerning the processing of personal data, which go beyond the scope proposed in the parliamentary bill.

The President of the Personal Data Protection Office (UODO) submitted further comments on the Act on the National Revenue Administration (KAS) in December 2024. In a letter to Marcin Łoboda, Deputy Minister of Finance and Head of the KAS, the President of the UODO highlighted an issue with Article 46a of the Act on the KAS, which concerns the exchange of information between the Minister of Health and the KAS authorities. According to the National Revenue Administration, this provision precludes the collection of data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, or data concerning that person’s health, sexuality or sexual orientation. This information constitutes special categories of personal data within the meaning of the GDPR and is subject to a higher level of protection. The President of the Personal Data Protection Office (UODO), however, noted that the wording of this provision is so general that it could also be interpreted as permitting the processing of such personal data. To prevent this, it must be clearly stipulated by law – as is the case with the provisions concerning the Supreme Audit Office (NIK), which expressly prohibit NIK auditors from processing special categories of personal data during audit activities.

“The processing of personal data by the National Revenue Administration (KAS) for analytical purposes ‘should be carried out exclusively on anonymised data. This should also be reflected in the law’,” emphasised Chairman Mirosław Wróblewski back in December 2025.

Similarly, Article 48 of the Act on the National Revenue Administration requires further clarification. In correspondence with the President of the Personal Data Protection Office (UODO), the National Revenue Administration explained that “the aim of the amended provision is to standardise and clarify the powers of the National Revenue Administration regarding access to banking information in cases where its authorities are conducting a preliminary investigation”.

“However, the extension in 2022 of the processing of personal data obtained under Article 48 of the Act on the National Revenue Administration, both in terms of the entities concerned and the subject matter, was not accompanied by any justification from the drafters as to the necessity of such a measure” – emphasised the President of the Personal Data Protection Office (UODO) in an administrative decision. He added, incidentally, that the Ombudsman had also drawn attention to the same issue.