Supreme Administrative Court: City guard can obtain personal data from an insurer under an automotive civil liability policy | In Principle

Until now, the administrative courts in Poland have issued only a handful of rulings on the statutory duty to maintain the confidentiality of insurance information. But in March 2026 the Supreme Administrative Court revisited this issue, holding that the city guard may demand information from an insurer under a civil liability policy for motor vehicles in order to punish the holder of a vehicle for illegal parking.

Insurance policy used as evidence to identify the perpetrator of a petty offence

At first glance, the Supreme Administrative Court judgment of 11 March 2026 (case no. III OSK 1068/23) doesn’t seem unusual. On several occasions, the administrative courts in Poland have examined which entities can request information from an insurer notwithstanding the duty to protect insurance secrecy. All of these cases raised doubts under Art. 35(2)(27) of the Insurance and Reinsurance Act, under which the duty to protect insurance secrecy does not apply to information provided at the request of “another entity whose right to demand the information arises under a separate statute.”

But this was the first time that the Supreme Administrative Court has decided whether a specific authority—not a natural or legal person acting in its own interest—can be regarded as “another entity whose right to demand the information arises under a separate statute.” The judgment is of vital importance for local government authorities, the municipal guards operating in different communes, insurers and others required to maintain insurance secrecy. In simple terms, the judgment examined whether the city guard can obtain from an insurer, or other entity required to maintain insurance secrecy, personal data of the holder of a vehicle in order to identify the perpetrator of a petty offence.

The dispute in the case arose in 2019, when the city guard sought information from an insurance company about the person who had insured a vehicle which was parked in violation of the regulations, in order to identify the perpetrator.

The insurer refused to turn over the requested information, on the grounds that “Art. 35(2) of the Insurance and Reinsurance Act allows the requested information to be provided only to entities mentioned in this provision.” The list included in this provision does not mention the city guard.

The commandant of the city guard in question filed a complaint with Poland’s data protection authority—the President of the Personal Data Protection Office (PUODO)—seeking an order to provide the personal data of the holder of the vehicle under Art. 8(2)(2) of the Act on Protection of Personal Data Processed in Connection with Preventing and Combatting Criminality. The commandant alleged that the right to request this information arises among other things from Art. 1(1) of the Municipal Guards Act, which states that the city guard is a uniformed service of the local government created for the purpose of protecting public order within the commune. (When the guard, with police-like functions, is established in an urban commune, it is called the “city guard” (straż miejska); in other communes it is known as the “municipal guard” (straż gminna).)

Consistent rulings by the data protection authority, the province administrative court, and the Supreme Administrative Court

As the dispute progressed, the commandant’s position was upheld by PUODO and all levels of the administrative courts.

First, the data protection authority ordered the insurer to provide the city guard with the name and home address of the holder of the vehicle, reasoning that the Municipal Guards Act obliges the city guard to take action for the purpose of protecting public order, while at the same time authorising the city guard to obtain the information needed to carry out its statutory duties. In this case, however, the vehicle data obtained by the city guard officers during their investigation from the Central Register of Vehicles and Drivers (CEPiK) was insufficient to determine the identity of the perpetrator of the parking violation. The only information at their disposal which would allow them to identify the holder of the vehicle was the number of the insurance policy for the vehicle.

In PUODO’s view, execution of the statutory tasks of the city guard requires it to use information about the persons affected by their actions. The Municipal Guards Act expressly provides that the city guard has a right to process personal data in connection with implementation of tasks defined by law, without obtaining the consent of the data subject. In turn, the city guard cannot prepare an application to punish the perpetrator of a petty offence without identifying the perpetrator, because under Art. 57 §2(1) of the Petty Offences Procedure Code, such an application must contain the name and address of the alleged perpetrator, as well as other data necessary to determine the person’s identity.

In this situation, PUODO recognised that the city guard is entitled to demand the information referred to in Art. 35(2)(27) of the Insurance and Reinsurance Act, based on Art. 10a(1) of the Municipal Guards Act, Art. 17 and 54 of the Petty Offences Procedure Code, and Art. 13–14 of the Act on Protection of Personal Data Processed in Connection with Preventing and Combatting Criminality.

The insurance company sought review by the province administrative court, accusing PUODO of erroneous interpretation of the Act on Protection of Personal Data Processed in Connection with Preventing and Combatting Criminality.

In its judgment of 25 January 2023 (case no. II SA/Wa 1382/22), the Province Administrative Court in Warsaw upheld in full the views presented by PUODO in the challenged decision. As the court further stated: “The city guard is an entity with the right, pursuant to statute, to obtain information encroaching on the freedoms and privacy of persons, which are constitutionally protected rights,” citing the Supreme Administrative Court judgment of 5 February 2008 (case no. I OSK 37/07), which held that “the Municipal Guards Act not only authorises, but indeed obliges, the City Guard to obtain any and all data necessary to determine the perpetrator of a petty offence, and then submit to the court an application to punish the fully identified person.”

The insurance company filed a cassation appeal against the judgment of the province administrative court, again alleging erroneous interpretation of the provisions of substantive law cited above.

Finally, in the judgment of 11 March 2026, the Supreme Administrative Court denied the insurance company’s cassation appeal, fully sharing the views presented by PUODO and the province administrative court. The Supreme Administrative Court also pointed that similar rulings had been handed down in cases where the court was assessing whether the municipal guards were allows to access personal data covered by communications secrecy under Art. 160(1) of the Telecommunications Law (e.g. Supreme Administrative Court judgments of 19 March 2019 (I OSK 1429/17) and 6 March 2019 (I OSK 2677/16)). According to the court, it would be highly inconsistent to make a different holding here, as there was no basis for differentiating between the city guards’ access to information protected by insurance secrecy as opposed to communications secrecy, where the city guards’ right to obtain such data has the same basis. As the court aptly found, because the city guards are authorised to issue tickets for petty offences, by their nature they must have the means to identify the perpetrators.

Summary

This ruling is important for insurers and local government authorities for at least two reasons. It not only resolves a dispute over interpretation of Art. 35(2)(27) of the Insurance and Reinsurance Act, but also provides interpretive guidelines for the future if a similar dispute arises over the status of other authorities demanding access to personal data from insurance policies.

The judgment also confirms the existing line of decisions by the administrative courts in Poland concerning the authority of the city guards to obtain legally protected information in order to carry out their statutory tasks.

Mateusz Kosiorowski, adwokat, Mateusz Muszyński, Insurance practice, Wardyński & Partners