The president of the Polish data protection authority (UODO) has repeatedly spoken out against the access powers to citizens' banking information granted to the National Tax Administration (KAS), which are considered disproportionate and not compliant with the GDPR.

A parliamentary bill, examined by the Public Finance Committee on September 16, 2026, aims to amend Article 48 of the KAS law to limit its access to banking data. Currently, the KAS can obtain a wide range of information without judicial oversight. The proposed amendment would restrict this prerogative to only those persons having the status of suspect in a procedure, with any other access requiring court authorization. This proposal, which could be integrated into the banking law, responds to requests made by the president of the UODO since July 2024.

The president of the UODO emphasized that Articles 46a and 48 of the KAS law constitute a disproportionate interference with privacy and the right to data protection. He warned about the risks related to the processing of special categories of data, profiling, and the use of data for purposes not provided for by law, such as analysis, which should be carried out exclusively on anonymized data. He also noted that Article 46a, concerning the exchange of information with the Ministry of Health, is formulated too broadly and could allow the processing of sensitive data, recommending an explicit prohibition modeled on the law governing the Supreme Audit Office (NIK). Finally, he recalled that the expansion of the KAS's powers in 2022 was not justified by necessity, a point also raised by the Ombudsman for Civil Rights.