Enforcement · Polish National Personal Data Protection Office (UODO) NL LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

ING Bank Śląski: Onvoldoende juridische basis voor de verwerking van gegevens.

4.323.250 euro boete - Pools Nationaal Bureau voor de Bescherming van Persoonsgegevens (UODO).

4.323.250 euro boete - Pools Nationaal Bureau voor de Bescherming van Persoonsgegevens (UODO).

€4,323,250 Fine
ING Bank Śląski
POLAND
Insufficient legal basis for data processing
Art. 5 GDPR Art. 6 GDPR
Financiële dienstverlening, verzekeringen en consultancy.
Personal Data Processing Accountability Insurance
Aug 26, 2025 Source uodo.gov.pl

Full text

De Poolse Autoriteit Persoonsgegevens heeft ING Bank Śląski een boete van 4.323.250 euro opgelegd. De bank heeft de identiteitsdocumenten van alle klanten en potentiële klanten gescand zonder een voldoende juridische basis. De bank begon met deze procedure nadat een wet tegen witwassen was ingevoerd, maar heeft niet onderzocht of de gegevensverwerking in elk geval noodzakelijk was.

GDPR-artikelen: Artikel 5 (1) a), b), c) GDPR, Artikel 6 (1) GDPR

Deze inhoud is automatisch vertaald met behulp van machinevertaling. De originele versie is beschikbaar in de brontaal.

How it connects

References

Related across sources

Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Guidelines ·EDPB Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design
C-667/21 ZQ v Medizinischer Dienst der Krankenversicherung Nordrhein, Körperschaft des öffentlichen Rechts The CJEU (Third Chamber) ruled on a preliminary reference from the Bundesarbeitsgericht in a case where ZQ sought compensation from his employer, Medizinischer Dienst der… CJEU ·Third Chamber Dec 21, 2023 Health Data Healthcare Integrity and Confidentiality Principle
C-65/23 MK v K GmbH In a preliminary ruling requested by the German Federal Labour Court (Bundesarbeitsgericht), the Court of Justice of the European Union interpreted Article 88 of the GDPR… CJEU ·Eighth Chamber Dec 19, 2024 Personal Data Integrity and Confidentiality Principle Legitimate Interest
C-60/22 UZ v Bundesrepublik Deutschland In Case C-60/22, the CJEU (Fifth Chamber) ruled on a preliminary reference from the Verwaltungsgericht Wiesbaden concerning UZ, a third-country national, and the Bundesrepublik… CJEU ·Fifth Chamber May 4, 2023 Right to Restriction Right to be Forgotten Personal Data
C-807/21 Deutsche Wohnen SE v Staatsanwaltschaft Berlin C-807/21 (Deutsche Wohnen) CJEU Dec 5, 2023 Fines Public Authority Processors
C-231/22 État belge v Autorité de protection des données In Case C-231/22, the Court of Justice of the European Union interpreted Article 4(7) and Article 5(2) of the GDPR in response to a preliminary reference from the Brussels Court… CJEU ·Third Chamber Jan 11, 2024 Controllers Personal Data Public Authority
Related documents