ING Bank (the controller) is a bank
One of the services the controller offers is to make contactless payments using an Android phone.
This was initially done through its own app, however, the controller later discontinued this and offered the contactless payment through Google Pay. To activate Google Pay, data subjects have to create an account with Google. When making a payment, the controller shares data related to the payment and store to Google. Two Dutch consumer’s organisations (the “Benadeelden in Actie” Foundation, or SBIA and Consumer Union) demanded that the controller discontinue Google Pay, and requested it to share its data. The controller stated that it had reached agreements with Google regarding data processing for contactless payments, but it refused to disclose those agreements. The consumer organisations therefore filed a case with the court, requesting it to order the controller to provide access to the agreements. The organisations also requested access to additional documentation, such as (draft) decisions and research data. They argued that they questioned the lawfulness of the processing of personal data in relation to contactless payments, and needed access in order to verify whether this processing was lawful. The controller, on the other hand, argued that the argument was unsubstantiated because the processing was lawful. The organisations argued that ING and Google acted as joint controllers in accordance with Article 26 GDPR. ING disputed this, and argued that it was only a joint controller with Google for the activation of tokens when making a payment. Holding — The court also clarified that ING Bank and Google were joint controllers, in accordance with Article 26 GDPR. The court dismissed the argument that ING and Google were joint controllers only in a specific instance (activating tokens). The court stated that both companies aimed at enabling data subjects to make contact payments with their phones using Google Pay. The court considered this a jointly defined purpose. Furthermore, the companies do not limit their data exchange to tokens; for example, Google stored the payment data to generate payment summaries. In terms of further processing of the personal data by Google (e.g. for advertising purposes), the court held that the ING may have a certain duty of care. This means that ING may have the obligation to implement safeguards to prevent the processing of data for contactless payments for any other purpose. The court also stated that the data subjects can hold ING liable for a breach of this duty of care. In terms of access, the court assessed whether the organisations had this right under the code of civil procedure rather than the GDPR. The court first stated that the request for access applied to ING Bank and not ING Group (the entity the organisations had initially brought the case against). This is because the parent group ING Group did not have a banking license. The court stated that the organisations have a legitimate interest in reviewing the agreements to assess whether they are sufficient and whether the companies are processing the data lawfully. Finally, the court noted that the organisations may determine the relationship (i.e. whether a joint controllership existed) between the companies based on this access request. The court ordered the controller to provide the organisations with access to the agreements between ING and Google. This includes how data subjects’ data will be processed (business sensitive information could be redacted. However, the controller did not have to grant access to the other requested data (e.g. research data or internal correspondence).
How it connects
References
Related across sources
Full text 52 paragraphs
195 Rv). The claim is partially assigned: ING will have to provide access and copies of agreements between ING and Google that relate to the offer of contactless payment by ING for consumers with an Android device via Google Pay. ING does not have to provide access to the other advanced data (research data, correspondence within ING and DORA analysis), because these data have been used to prepare the agreements made with Google and the legal position of consumers are therefore not determined, and with regard to the DORA analysis, IT has not been shown that ING has DORA documentation. Find places Rechtspraak.nl Enriched verdict Pronunciation COURT Amsterdam Civil law Case number / request number: C/13/781904 / HA RK 26-13 Order of 16 July 2026 in the case of
CONSUMER UNION, in The Hague, 2 THE FOUNDATION DISADVANTAGED IN ACTION, in Amsterdam, requesting parties, hereinafter referred to as: Consumers' Association and SBIA, Attorney: Mr. D.F. Birch, against 1 ING GROUP N.V., in Amsterdam, 2 ING BANK N.V., in Amsterdam, defendants, hereinafter referred to as: ING, Attorney: Mr. P.H.M. Brother. 1 The procedure
The course of the procedure is evidenced by: - the application received at the Registry on 15 January 2026, with productions 1 to 17, - the interim decision of 5 March 2026, which provided for the oral procedure, - the defence received at the Registry on 22 May 2026, with productions 1 to 10, - additional productions of Consumentenbond and SBIA, with productions 18 and 19, - the record of the oral procedure of 3 June 2026.
The decision is determined today.
The Facts
The Consumers' Association is a consumer organisation, representing the interests of Dutch consumers, with more than 427,000 members. SBIA is a foundation that represents the interests of disadvantaged people, such as consumers, including by carrying out collective actions.
The ING Bank is a Dutch bank with a banking license. ING Groep is the head of the ING group and does not have a banking license.
ING offers its account holders the possibility to pay contactless with an Android phone. First this was done via its own app “ING Mobile Payment”, where account holders had a digital portfolio with payment cards that were linked to their ING account. On 17 September 2024, ING abolished its “ING Mobile Payments” app, and since then ING has been offering the contactless payment functionality with an Android phone exclusively via Google Pay.
To activate Google Pay, an account holder must have a Google account. If an account holder activates Google Pay, ING shares the name, address and phone number of the account holder with Google. When an account holder uses Google Pay to pay contactless with his phone, the date, time and amount of payment is shared with Google, and also the name and location of the store. These data are necessary for the payment. In addition, the data is also used by Google to create a payment statement of the past thirty days.
When activating Google Pay, an account holder from ING will see a screen with the heading “What happens to your data?”. This briefly explains what data is shared with Google for making a payment, as described above (see 2.4). In addition, reference is made to Google’s Privacy Statement and Google Pay’s Terms of Service. When activating Google Pay, Google also refers to various documents: Google Payments Terms of Service, Privacy Notice, Google Pay Terms of Service, and Google Privacy Policy.
Consumers’ Association and SBIA are concerned about the privacy of ING’s account holders who use Google Pay. The Consumers Association summed ING in a letter on 8 April 2026 to stop Google Pay and requested that data be shared, but ING has not complied with it. The Consumers’ Association and ING have entered into consultations with each other. In that conversation, ING indicated that it has made agreements with Google about the data processing when contacting Google Pay, but ING does not want to share those agreements with the Consumers’ Association and SBIA. After that, on 27 November 2025, Consumentenbond and SBIA sent another letter of summation, in which they summed ING to provide data. ING did not respond to this either.
The request and the defence
Consumers' Association and SBIA request the court to make available by disposal, as much as possible with stock, ( (i) to impose a commandment on ING to provide the following information in a copy and for inspection to the Consumers' Association and SBIA within fourteen days of the date of the decision, a. Google Pay agreements between ING and Google. The agreements between ING and Google that relate to the offer of contactless payment by ING for consumers with an Android device via Google Pay, including in any case: 1 The agreement on the basis of which ING is able to offer customers contactless payment via Google Pay; 2 The further agreements between Google and ING in the context of Google Pay’s offer by ING, or the stopping of ING with its own app ING Mobile payment. (Concept) decisions and discussion reports. All draft and established minutes (including similar discussion reports) and draft and established decisions within ING and its affiliates on (i) the abolition of ING Mobile Payments and (ii) the introduction of Google Pay as a medium for contactless payment. Research data. (i) The research questions, (ii) the underlying data used for the research and (iii) the possible draft versions of research reports and comments on them by ING and/or researchers, of the research that ING has done on Google Pay and on the way in which personal data that Google obtains through the ING bank account of the consumers. Correspondence within ING. The relevant correspondence between ING and Google about the introduction of Google Pay for contactless payment, including but not limited to the communication that looks at any agreements / coordination about the data processing policy in the context of contactless payment. DORA analysis and appointments. The (mandatory) analysis that ING has made on the basis of DORA regulations, as well as the agreements made with Google in the context of DORA, including but not limited to the agreements ex. article 30 DORA. (hereinafter together: the “Requested Data”) with further provision that the data in copy and for inspection are made available in the following way: (a) digitally and in a digitally searchable manner, (b) clear with data divided into (sub)folders and under the guidance of a document that explains the (sub) folders, (c) to all data files to provide them with an explanation of which types of data are in which way are in which category hardcopyhard copyare displayed in the relevant data files, (d) if part of the data is not available ( ii) Strengthen the exhibition commandment under the burden of penalty payment, and to require ING to pay a penalty payment of € 1,000,00 per day that the commandment is not fully met, (iii) to require ING to bear all costs involved in the access and issue of the specified data requested by Consumentenbond and SBIA, ( iv) to convict ING in the costs of the proceedings, with statutory interest from the eighth day after the date of the decision if ING does not pay those costs within seven days of the date of this decision.
The request was based on the Consumers' Association and SBIA. Consumers' Association and SBIA question the lawfulness of the processing of personal data within the framework of Google Pay, and the way in which Google subsequently deals with that data. In order to be able to check this legality, Consumentenbond and SBIA require access to information from ING that relates to this. Consumers' Association and SBIA stand up for the interests of the consumers who are handed over by ING to Google Pay, namely the account holders of ING with an Android device who want to pay contactless with their phone.
ING opposes the allocation of the request and argues for this purpose. ING and Google have agreed that Google will process the data in accordance with the privacy laws and regulations. Moreover, there is no reason to believe that Google processes the data unlawfully and the statements of Consumentenbond and SBIA are not substantiated.
The statements of the parties are then, where relevant, discussed further.
The assessment The claim for access pursuant to Article 194 and 195 of the Rv
A party has the possibility to request access to certain data through the court through Article 194 in conjunction with Article 195 of the Rules of Procedure. The right to access it belongs to (a) a party to a legal relationship, if that party (b) has sufficient interest in this. The other party is not obliged to give access if it can invoke a right of withdrawal or if important reasons stand in the way of it.
If the application is granted, the court shall determine the conditions under which, the manner in which and the time limits within which the other party must comply with the request.
The court considers that the claims of Consumentenbond and SBIA can be limitedly assigned, and explains its judgment below. ING Group
Consumers' union and SBIA have both ING Group N.V. (ING Group) as ING Bank (ING Bank) N.V. involved in this procedure. According to ING, there is no ground to involve ING Group, because only ING Bank has a banking license and offers its account holders the possibility to use Google Pay. ING Groep does not carry out banking activities and is not involved with Google Pay, according to ING.
The court considers that there are currently insufficient indications that ING Groep has (had) direct interference with the cooperation with Google and the agreements made in the context thereof. Therefore, the request for access to ING Groep will be rejected. After this, ING is only understood to mean ING Bank. Relevant legal relationship
Consumers' Association and SBIA argue that there is a legal relationship, because ING acts unlawfully towards consumers by facilitating contactless payment via Google Pay. Consumers' union and SBIA stand up for the interests of the consumers who make use of it. According to Consumentenbond and SBIA, the unlawful action consists of the violation of fundamental rights, the General Data Protection Regulation (“GDPR”) and the Telecommunications Act (“Tw”), the banking duty of care and the Digital Operation Resilience Act (“DORA”).
As for the violation of the GDPR, Consumers’ Association and SBIA state that ING and Google are jointly controllers for the entire way in which contactless payment is offered via Google Pay. Based on Article 26 GDPR the parties are considered to be jointly controllers if they jointly determine the purposes and means of the processing.
ING believes that it is only jointly responsible for the ‘activation of the token’ and the associated processing of personal data, so that the customer can make use of contactless payment with an Android telephone via Google Pay. The activation of the token takes place when an account holder wants to make a contactless payment with his phone, where the token performs the same function as the information on a debit card. Because of that token, the payment terminal recognizes the customer's debit card. The bank of the retailer then makes contact with the bank of the cardholder, so that the bank can check whether the transaction is secure and the account holder has sufficient balance. Once that check has taken place, the bank of the account holder will return the result of that validation to the payment terminal and the payment may or may not have been successful. In the case of Google Pay, the card number of the debit card but the token will not be checked. Without this information, the payment cannot be made.
ING’s view that ING and Google are only jointly responsible for the activation of the token is incorrect. The collaboration of ING and Google is aimed at ensuring that account holders of ING can pay contactless with their phone with the help of Google Pay. This is a common purpose and in the context of that purpose, the same data are processed by both ING and Google. In addition, the ‘activation of the token’ also reveals the identity of the account holder at Google, because Google Pay is linked to the account holder’s Google account. But the exchange of the data is not only limited to the activation of the token and the identity of the account holder at Google, but it also includes providing the date, time and amount of payment, and the name and location of the store by ING. The processing of that personal data includes in any case the collection and storage of that data. That that data is stored by Google is evidenced by the fact that one of the functionalities of Google Pay is that the account holder can request an overview of the payments made with Google Pay.
ING and Google must therefore be considered as a joint controller for the processing of all data processed by them within the scope of Google Pay.
However, the question is whether that joint controller also extends to the possible further processing of the data processed by Google, if, for example, it would use that data to enrich the profiles of users for the purpose of offering them advertisements. The starting point is that the data have not been provided for that purpose and that data is then used for a purpose other than the processing necessary for payments and related functionalities such as keeping an overview of payments. The duty of care of ING may therefore entail that it stipulates guarantees for the benefit of its account holders in order to prevent the processing of data provided by it for another purpose. After all, this concerns personal data that are very privacy-sensitive.
Therefore, on the basis of the duty of care in the legal relationship between ING and its account holders that use Google Pay, the account holder can therefore address ING if there is a breach of that duty of care. This means, at the same time, that Consumers’ Association and SBIA can also take a collective action in which they stand up for the interests of the account holders of ING who use Google Pay, which means that there is a legal relationship between Consumentenbond and SBIA on the one hand and ING on the other. The fact that the unlawful action is not yet established at this stage does not detract from this. A request for access can be made in order to be able to investigate whether there is a legal relationship between the parties.1
Consumers' Association and SBIA state that given the content of the ING Terms and the lack of information that ING is willing to provide, is plausible that ING has not made with Google the agreements required by the Digital Operational Resilience Act (DORA).
ING argues against this claim that Google Pay does not fall under the DORA.
Whether the DORA applies to Google Pay does not need to be decided now. From ING’s point of view, it can be inferred that it has not made an analysis based on DORA regulations and that it has not made any specific agreements with Google. ING can only be ordered to provide access to data available to it. The advanced under e (DORA analysis and appointments) will therefore be rejected. Sufficient importance
ING states that it has made agreements with Google, in which parties have agreed that Google complies with the applicable (privacy) laws and regulations. Because these agreements are confidential, ING does not want to share this agreement with Consumentenbond and SBIA.
The processing of data is only lawful if there is a basis for processing, which are limited in Article 6 GDPR. . One of those processing bases is where the processing is necessary for the performance of a contract to which the data subject is a party (Article 6(1)(b) GDPR).
Consumers' Association and SBIA are concerned that Google’s processing of the data provided within the scope of Google Pay goes beyond what is necessary for the execution of the agreement. It is a fact of general awareness that Google’s revenue model is that it creates profiles of users to offer them targeted advertising. In addition, the Google Payments Privacy Notice states that Google may process the data it obtains for Google Pay in accordance with its more general Google Privacy Policy and that the data may be used for “ every day business purposes”. If Google processes the data further than necessary for Google Pay and agreed with ING (for example, when Google Pay further processes the data for advertising purposes), then that may be in violation of the GDPR, because it is then questionable whether Google has established a valid processing basis for this, according to Consumentenbond and SBIA.
ING states that it has made agreements with Google about the use of the data it provides to Google within the framework of Google Pay. To this end, ING and Google are also obliged to do so on the basis of the GDPR as jointly controllers. Joint controllers must transparently exercise their responsibilities for the fulfilment of the GDPR establish, in particular with regard to the rights of data subjects and the information obligations imposed on controllers. The core of this scheme should be made available to data subjects whose data are processed by the joint controllers (Article 26 GDPR).
Consumers' Association and SBIA have a legitimate interest to view the agreements between ING and Google in order to be able to assess whether the agreements are sufficient and to be able to assess whether or not the fear that Google processes the data of account holders of ING unlawfully or not.
ING’s view is that Consumers’ Association and SBIA have no interest in allocating the claims, because – in short – the Consumers’ Association will not start a procedure and SBIA will not meet the requirements of Article 3:305a of the Dutch Civil Code and will end a collective action on it. Moreover, consumers do not even want Consumers' Association and SBIA to start a collective action, according to ING.
In this case, the Consumers' Association has stated that it will also act as a claimant in a possible WAMCA procedure. Therefore alone, this defence is rejected, because in any case there is no reason in advance to doubt the admissibility of the Consumers' Association.
The defence that consumers would not wish for any procedure is rejected. Although it may be the case that consumers have indicated to ING the wish to use Google Pay, it has not been said that they would be against a procedure aimed at ensuring that their data is not used for purposes other than Google Pay. De vorderingen van Consumentenbond en SBIA worden deels toegewezen
Dat betekent dat de rechtbank de vorderingen van Consumentenbond en SBIA tot inzage in de overeenkomst(en) tussen ING en Google inzake Google Pay (verzoek onder i sub a) grotendeels toewijst, inclusief alle bijlagen. ING dient volledige openheid te geven over de bepalingen die betrekking hebben op de wijze waarop gegeven van rekeninghouders zullen worden verwerkt. Bedrijfsgevoelige informatie mag onleesbaar worden gemaakt, maar de kopjes en opschriften van artikelen of bijlagen mogen niet onleesbaar worden gemaakt.4.25. The part requested in part (i) under a of the request, “whether ING discontinues its own app ING Mobiel betalen,” is not granted, because it is not apparent what agreements relevant to Consumentenbond and SBIA regarding this could have been made between ING and Google.
The confidentiality agreed upon between ING and Google regarding the agreements made by them does not preclude the granting of the request. The decisive factor for the granting is whether the applicant has sufficient interest, and an agreement between third parties cannot stand in the way of this. Moreover, a portion of the agreements between ING and Google must already be publicly known, based on Article 26 of the GDPR.
The assertion by ING that Consumentenbond and SBIA are abusing the right of access regulation is not accepted. Consumentenbond and SBIA have actually explained that they themselves are considering initiating a class action against ING and that they require this data for that purpose. Furthermore, ING has not substantiated its claim that Consumentenbond and SBIA will only use the data for the ongoing collective action against Google by the Foundation for the Protection of Privacy Interests.
Consumentenbond and SBIA have insufficient interest in the other requested data (requests ii through v), because these served to prepare for the agreements made with Google, and the legal position of the consumers represented by Consumentenbond and SBIA is not determined by them. That legal position is, in fact, determined solely by the agreements concluded between ING and Google. The manner in which access and copies must be provided
The request regarding part (i) under a is (largely) granted. ING will be required to provide access and a copy by providing, within six weeks of the date of this decision, a paper copy and a searchable PDF file of: “The agreements between ING and Google relating to the offer of contactless payment by ING for consumers with an Android device via Google Pay, including in any case: The agreement on the basis of which ING is able to offer contactless payment via Google Pay to customers; The further agreements between Google and ING in the context of the offer of Google Pay by ING.” In doing so, commercially sensitive data may be rendered illegible as considered under 4.24.
The costs of providing access shall be borne by Consumentenbond and SBIA pursuant to the provisions of Article 194 paragraph 1 of the Dutch Code of Civil Procedure. The request under (iii) to charge these costs to ING must therefore be rejected. Penalty payment
The court sees no grounds to impose a penalty payment on ING, because ING has pledged to provide access if it is ordered to do so. The court therefore rejects the request to determine a penalty payment. Provisionally enforceable
Consumentenbond and SBIA have requested that the decision be declared provisionally enforceable. ING opposes this to prevent being obliged to irreversibly share information, while it might subsequently be established on appeal that there were no grounds for doing so. Consumerenbond and SBIA, in turn, argue that the suspensive effect of the appeal could lead to significant delays in initiating a collective action.
The court will have to weigh the interests of both parties here. With provisional enforceability, there is a possibility that ING has provided access, while there is no entitlement to it afterwards. The Explanatory Memorandum to the new law of evidence states the following regarding that situation: “If the court's decision ordering access to, a copy of, or an extract of certain data is overturned on appeal or in cassation, then, in retrospect, there is no right to access the provided data. The proposed third paragraph of Article 195 stipulates that as soon as that decision has become final (“has entered into force”), the data of which access, a copy, or an extract has been provided shall be returned to the opposing party without undue or unnecessary delay. Copies, electronically stored files, and other data that are not suitable for return must be destroyed at the same time. Withholding these data is unlawful and may lead to liability for damages.”2
The court will declare the decision provisionally enforceable, because the obligations mentioned in the explanatory memorandum sufficiently satisfy ING's interests in the event of the annulment of this decision, and the interest of Consumentenbond and SBIA in receiving the data immediately outweighs them. Legal costs
Since the claims of Consumentenbond and SBIA have been awarded only to a small extent, the court sees reason to offset the legal costs. Each party shall bear its own costs. Because ING Bank and ING Groep conducted a joint defense, of which the defense on behalf of ING Groep was a minor part, the costs of ING Groep are assessed at nil.
The decision The court 5.1. orders ING Bank to provide Consumentenbond and SBIA with access to and a copy of the records within six weeks of the date of this ruling in the manner stated under 4.29, 5.2. declares this judgment provisionally enforceable, 5.3. offsets the costs of the proceedings, in the sense that each party bears its own costs, 5.4. rejects the remainder of the request. This decision was rendered by Mr. R.H.C. Jongeneel and pronounced in public on 16 July 2026. 1 Parliamentary Papers II 2019/20, 35498, no. 3, p. 13. 2 House of Representatives, parliamentary year 2019–2020, 35 498, no. 3, p. 54. Help with searching An extensive manual is available for searching for judgments, including explanations regarding: Search by date of judgment/publication Search by keywords Search by ECLI or LJN Search by area of law Find locations for judgments Find judgments at locations Selection criteria The Judiciary, the Supreme Court of the Netherlands, and the Council of State publish judgments based on selection criteria: Judgments in multi-judge chamber cases Judgments of the Supreme Court and appellate courts Judgments with media attention Judgments in criminal cases European law Guideline judgments Recusal Full selection criteria Weekly overview Select a week and view which judgments have been added to the judgment register in that week. Weekly overview of judgments English Sitemap Privacy Cookies Accessibility Spoofing Vacancies Archive Disclaimer Follow us twitter facebook facebook linkedin youtube Stay up to date rss email