The Polish Supreme Administrative Court issued a groundbreaking ruling on October 17, 2025 (case no. III OSK 2223/22) concerning the processing of personal data in the National Police Information System and the requirements for their deletion when processing is no longer necessary. This judgment sends an important message to individuals whose data are stored in police databases — both to those whose criminal proceedings have been discontinued and to those who have not been convicted by a final judgment.
This ruling by the Supreme Administrative Court confirms that the data protection authority — in this case, the President of the Personal Data Protection Office — has the competence to determine whether further processing of data in the system is justified, and that their automatic and indefinite storage cannot be justified solely on the basis of the Police’s statutory duties.
In practice, the case concerned a man who, more than seven years earlier, at the age of 18, had caused a traffic accident. The criminal proceedings were conditionally discontinued, yet his data were still retained in KSIP. The Court held that, with regard to a person not convicted by a final judgment for an intentional crime, further processing without a specific purpose is unjustified.
“Processing without a time limit could lead to a violation of fundamental principles such as data adequacy, minimization, and fairness,” the Court noted.
This judgment is great news for individuals applying for firearm permits who once had “run-ins” with the justice system — those whose criminal records in the Polish National Criminal Register have been expunged, yet the police continued to persistently retain their data in their system. Hopefully, this ruling will put an end to such practices. The decision clearly confirms that individuals whose data are processed in the system have the right to request their deletion if the purpose of processing no longer exists or its further necessity cannot be demonstrated.
Previous practices of processing data “just in case,” without a defined deletion period, have been found by the Supreme Administrative Court to be inconsistent with data protection law and constitutional principles of privacy protection. This is particularly important for those who have not been convicted by a final judgment or whose proceedings have been discontinued — their data protection rights have now been reinforced.
Source: Niebezpiecznik
