PESEL number restriction. Is this the end of identity theft?

But… what’s the deal with PESEL protection?

PESEL protection essentially marks it in databases accessible to third parties (such as databases verified by lending companies) as unauthorized to perform legal actions.

However, implementing PESEL protection in registers is primarily intended to protect against attempts to use the PESEL by an unauthorized third party, which consequently aims to limit the possibility of either incurring an obligation or potentially releasing the injured party from financial responsibility for obligations incurred using their data without their knowledge.

The purpose of PESEL protection is therefore to prevent incurring debts using stolen identifying data of a given person, e.g., so-called payday loans, other credits, or opening savings and settlement accounts that could be used in criminal activity. But that’s not all.

PESEL protection is also meant to protect property rights, as notaries will be obligated to verify it before performing notarial acts. Additionally, verification will become mandatory in situations involving issuing SIM card duplicates (i.e., preventing SIM swapping). The protection should be checked when concluding leasing agreements and withdrawing cash at bank branches/ATMs in amounts exceeding three times the minimum wage.

The main effects of PESEL protection will therefore be removing the burden of proving that one did not enter into a loan agreement, sign a given notarial act, or make an unauthorized cash withdrawal. Thus, identity theft victims will be released from, for example, bearing responsibility for credit they did not take out.

How will it be possible to protect PESEL?

PESEL protection is free of charge and takes place in a convenient electronic form, i.e.:

• in the mObywatel app or in the mObywatel.gov.pl service within the ePUAP profile.
• Besides this, it’s possible to make the protection at the municipal office, bank and SKOK branch, and Polish Post office.

PESEL protection takes place in real time (also with specification of the exact second of protection), but there’s also the possibility of indicating the exact time from which the PESEL protection should be effective.

There also remains the option of free cancellation of PESEL protection as well as so-called temporary cancellation with specification of a new date for its protection.

Protection and cancellation actions can be performed multiple times.

Importantly, PESEL protection can be made by an attorney holding special power of attorney authorizing them to perform the protection action, but only through a paper application submitted at the municipal office. In this procedure, a legal guardian and curator may also apply.

(!) The PESEL protection register will collect data only concerning adults.

Every PESEL holder will be able to check the history of verification of their PESEL by given institutions and companies along with the history of making given protection and cancellation – which is meant to serve evidential purposes.

How is PESEL protection supposed to work in practice?

Let’s imagine that in December 2024, Mr. Jan goes to the bank wanting to conclude a credit agreement, but exactly a year ago he protected his PESEL. What actions should Mr. Jan take to get the credit?

• Mr. Jan will have to cancel the protection of his PESEL, and after concluding the credit agreement, make its subsequent later protection (of course, when he’s still interested in maintaining its protection).

However, what should the bank do when a person claiming to be Mr. Jan approaches them to conclude a credit agreement using his data?

• The bank should verify whether the PESEL has been protected, and if so, should refuse to grant the credit.

And what if the bank doesn’t refuse? This would mean granting credit with the inability to satisfy their claim from the PESEL holder.

What about deferred payments?

There will be no obligation to verify PESEL protection in the case of purchases on e-commerce platforms, which is meant to facilitate making online purchases with deferred payments.

However, for the exclusion to take place, the following conditions must be met jointly:

1. the credit amount must go directly to the seller, not the borrower;
2. the contract must be concluded via the Internet;
3. the consumer was authenticated by the seller using individual authentication data, i.e., through;
4. credit is granted in connection with a continuous contract for a value not higher than the minimum wage;
5. before concluding the continuous contract, PESEL protection verification takes place and the consumer is informed about the lack of verification of this protection before granting given credits under this contract.

From when will it be possible to make PESEL protection?

According to the communication of the Minister of Digitization of October 31, 2023, regarding the determination of the deadline for implementing technical solutions enabling the application of provisions concerning the maintenance of the register of PESEL number protections and certain related services (M. P. of 2023 item 1194), PESEL protection has been possible since November 17, 2023.

However, the so-called full entry into force of the amending act will only occur on June 1, 2024, because then verification of PESEL protection by obligated entities will be mandatory.

Do we have other possibilities to protect our PESEL?

When it comes to data protection that we can obtain, there’s a range of various solutions available on the market. Certainly, any choice should be dictated by one’s own needs and goals that the interested person is seeking.

Currently, some of the available and non-public options on the market that we can use to protect our data are, for example:

• bezpiecznypesel.pl,
• BIK Alerts,
• Chroń PESEL.

bezpiecznypesel.pl is an option launched by the Polish Association of Lending Institutions and CRIF sp. z o.o., which mainly brings together non-bank institutions. It’s a free mechanism that works on a similar principle to the future statutory system, which means that multiple PESEL protection and cancellation is possible. However, before granting a loan to a given consumer, the given non-bank institution should verify their PESEL in the bezpiecznypesel.pl database, and in case of its display, refuse to grant the loan.

BIK Alerts are paid services and constitute continuous data monitoring, which means that when a given institution checks a given person in the Credit Information Bureau, the alert holder will receive an SMS about it. This, in turn, is meant to help the latter take immediate actions that will prevent fraud. These actions would be taken in cooperation with BIK, which would constitute effective support in thwarting identity theft.

In turn, Chroń PESEL is a service supported by another institution in the credit world, i.e., the National Debt Register. It also works on the principle of paid SMS notifications, monitors PESEL inquiries, controls newly established companies for possible identity theft, and can provide legal support in cases of fraud and unauthorized use of data (with the option of reimbursing legal service costs).

It should be remembered that there are also other alternative and non-public ways enabling PESEL protection.

Therefore, if someone were interested in choosing a solution aimed at limiting the risk of fraud or other unauthorized use of their personal data, they should primarily consider the risks associated with where their data might appear and to what extent this personal data might be vulnerable: such as considering risks associated with conducting business (e.g., PESEL disclosure in publicly available registers). Besides this, the choice should be justified by the presumed threats that the given person would like to avoid.

[1] https://isap.sejm.gov.pl/isap.nsf/download.xsp/WDU20230001394/T/D20231394L.pdf

[2] https://monitorpolski.gov.pl/M2023000119401.pdf

[3] The above-mentioned examples of services offered by commercial entities were cited in the Regulatory Impact Assessment of the Act of 7 July 2023 amending certain acts to reduce certain effects of identity theft (Journal of Laws 2023, item 1394), https://orka.sejm.gov.pl/Druki9ka.nsf/0/06CC7AD18E8FBC09C12589B7003C26A8/$File/3251.pdf [accessed: 4.10.2023]. Their inclusion was intended to demonstrate that there is currently no way to fully restrict the use of one’s personal data that would result in the blocking of a specific legal action. Rather, it aimed to indicate that mechanisms currently exist that can mitigate the effects of data misuse. However, it should be noted that these are not the only solutions presently available on the market but were selected as examples by the Ministry of Digital Affairs.

Authors:

• trainee attorney-at-law Mariola Połeć

• attorney-at-law Witold Masionek