Mirosław Wróblewski, President of Poland’s Personal Data Protection Office (UODO), has called on Finance and Economy Minister Andrzej Domański to begin legislative work aimed at guaranteeing people who have completed cancer treatment an effective right to be forgotten in the financial sector. The proposal primarily concerns limiting the use of information about a previous cancer diagnosis by banks and insurers when assessing creditworthiness and insurance risk.
According to UODO, the current rules do not provide people who have completed treatment with sufficient protection against the long-term consequences of disclosing their medical history. Cancer survivors may face higher insurance premiums, refusals to provide coverage or more difficult access to financing, even when treatment ended many years earlier.
Medical history without a clear time limit
The right to be forgotten is provided for in Article 17 of the General Data Protection Regulation (GDPR). It is also referred to in Article 51(4) of the Polish Constitution. In practice, the principle means that personal data may be erased when they are no longer needed for the purpose for which they were collected.
In the case of information concerning previous cancer diagnoses, however, the issue is complicated by the specific nature of the financial sector. Banks and insurers may use medical data when assessing credit or insurance risk. According to the supervisory authority, the absence of clear time limits means that a person’s medical history may affect their financial situation for a very long time after treatment has ended.
UODO argues that such practices may lead to unequal treatment of people who have recovered from cancer. This applies both to life and health insurance, as well as to policies linked to loans, where insurers assess the risk of non-repayment partly on the basis of a customer’s health status.
EU recommendations and solutions in other countries
The European Parliament has pointed out that cancer patients should not face a “double penalty” after completing treatment. In a resolution on the fight against cancer, MEPs called on EU Member States to guarantee patients the right to be forgotten by no later than 2025.
According to proposals discussed at EU level, information about a cancer diagnosis should no longer be used after ten years from the end of treatment. For people diagnosed before the age of 18, the period would be reduced to five years.
Similar solutions are already in place in several European countries, including France, Belgium and Luxembourg. Their purpose is to prevent an old diagnosis from automatically resulting in less favourable credit or insurance terms, regardless of the patient’s current health condition.
New rules would cover only part of the market
The issue of the right to be forgotten has been partly addressed in EU Directive 2023/2225 on consumer credit agreements. It requires Member States to introduce national rules limiting the use of data relating to a cancer diagnosis when arranging insurance linked to a credit agreement.
The maximum permitted period for processing such data may not exceed 15 years from the end of treatment. Poland’s draft amendment to the Consumer Credit Act provides for a more far-reaching solution: after five years from the end of treatment, cancer-related data could no longer be obtained or used when entering into credit repayment insurance agreements.
According to UODO, this would be an important step, but it would cover only a narrow segment of financial services. Rules relating to credit repayment insurance would not solve the problem for other types of insurance, including life insurance, health insurance and products offered independently of consumer loans.
UODO calls for broader legislative change
The President of UODO notes that the current rules allow medical documentation to be shared with insurers with the patient’s consent. This follows, among other things, from regulations concerning patients’ rights and insurance and reinsurance activity.
However, the authority stresses that under the principle of data minimisation, personal data should be processed only to the extent necessary to achieve a specified purpose and only for as long as necessary. In UODO’s view, the lack of clear time limits on the use of information concerning previous cancer diagnoses raises concerns from the perspective of the protection of fundamental rights.
In his letter to the Finance and Economy Minister, the President of UODO therefore calls for measures covering financial services in the broad sense. Such rules would give people who have completed cancer treatment a real opportunity to exercise their right to be forgotten, while also setting clear standards for banks and insurers.
The case has been registered under reference number DPNT.413.13.2026.
