Romania

ING BANK NV AMSTERDAM - SUCURSALA BUCUREȘTI

5,000 €

GDPR enforcement action by Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) on 2026-11-04.

Rank · Sector

#253

of 344 in Finance, Insurance and Consulting

Rank · Romania

#108

of 302

Rank · All fines

#1,992

of 3,275

Case details

Authority: Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP)
Date: 2026-11-04
Controller / Processor: ING BANK NV AMSTERDAM - SUCURSALA BUCUREȘTI
Sector: Finance, Insurance and Consulting
Quoted Articles: Art. 32 (1) b), d), (2), (4) GDPR
Type of violation: Insufficient technical and organisational measures to ensure information security

Summary

The Romanian DPA has imposed a fine of EUR 5,000 on ING BANK NV AMSTERDAM - SUCURSALA BUCUREȘTI. After a breach notification to the DPA, it was found that access rights were poorly configured aswell as not being limited. An amployee therfore was able to access bank data of a significant number of data subjects holding accounts at the bank. The peronal data accessed contained customer codes, account balances, monthly income and information on transactions.

Open original source Links to the regulator's original publication or another source.