Today, an amendment to the Banking Law (Articles 106d-106e) takes effect, expanding the catalog of entities listed in those provisions to include "financial institutions whose core business is the provision of assets under a leasing contract or the provision of factoring services," an important change for the industry. This is because factoring companies have been included in the group of entities authorized by the provision to exchange information for the purpose and to the extent necessary to prevent the crimes indicated therein. This is an important change in terms of the comprehensive establishment of anti-fraud systems, including in financial industry groups. The amendment will allow processing of information on convictions from other financial market participants, as well as from business intelligence agencies.
It is worth recalling that the provision contains an explicit legal basis for processing and sharing information, including information covered by bank secrecy and information on convictions, in cases of crimes committed against banks, other institutions statutorily authorized to grant credit, credit institutions, financial institutions, lending institutions, leasing companies and factoring companies, for the purpose and to the extent necessary to prevent such crimes. The original amendment of the provision (2018) is a direct result of the demands of the ZBP regarding the need to supplement the content of Article 106d of PrBank with the possibility of processing conviction information in banks' anti-fraud systems due to Article 10 of RODO, which refers to the need to include in national law the grounds for processing such information. The provision of Article 15 RODO does not apply to the processing of personal data to the extent that it is necessary for the proper performance of anti-money laundering and terrorist financing tasks, in accordance with Article 106, and the prevention of crimes, in accordance with Articles 106a and 106d of PrBank.
In the context of RODO, it is worth mentioning that:
- Article 106e excludes the application of Article 15 of the RODO;
- The change should result in the adaptation of information on the processing of personal data to the new legal status (adding the legal basis and purpose of processing);
- On the application of this provision, the President of the Office for the Protection of Personal Data (UODO) expressed his opinion in a decision dated February 20, 2020, ref. ZKE.440.67.2019.
