The Netherlands

International Card Services B.V.

150,000 €

GDPR enforcement action by Dutch Supervisory Authority for Data Protection (AP) on 2024-01-15.

Rank · Sector

#71

of 322 in Finance, Insurance and Consulting

Rank · The Netherlands

#25

of 43

Rank · All fines

#412

of 3,050

Case details

Authority: Dutch Supervisory Authority for Data Protection (AP)
Date: 2024-01-15
Controller / Processor: International Card Services B.V.
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 35 GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Dutch DPA has imposed a fine of EUR 150,000 on International Card Services B.V. (ICS). ICS failed to carry out a data protection impact assessment before starting the digital identification of customers in the Netherlands in 2019. The identity check covered around 1.5 million people and involved sensitive personal data such as pictures of the data subjects.

Open original source Links to the regulator's original publication or another source.