Poland

ING Bank Śląski

4,323,250 €

GDPR enforcement action by Polish National Personal Data Protection Office (UODO) on 2025-08-26.

Rank · Sector

of 322 in Finance, Insurance and Consulting

Rank · Poland

of 111

Rank · All fines

#82

of 3,050

Case details

Authority: Polish National Personal Data Protection Office (UODO)
Date: 2025-08-26
Controller / Processor: ING Bank Śląski
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 5 (1) a), b), c) GDPR, Art. 6 (1) GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Polish DPA has imposed a fine of EUR 4,323,250 on ING Bank Śląski. The controller scanned the identity documents of every customer and potential customer without a sufficient legal basis. The controller started to implement this procedure after an anti-money laundering law was introduced, but failed to assess the necessity of the data processing in each case.

Open original source Links to the regulator's original publication or another source.