News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Rb. Rotterdam - ROT 25/7371

GDPRhub
Controllers Supervisory Authorities
Jul 14, 2026 Source

Content

A court upheld the DPA’s decision to dismiss a case related to a bank’s use of contactless payment chips on debit cards. The court considered that the DPA had sufficiently investigated the case. English Summary. Facts. ING Bank N.V. (the controller) is a bank. In 2022, several data subjects brought a complaint to the DPA regarding the controller’s contactless payments. The data subjects requested the controller to issue debit cards without a chip that would enable contactless payments. The controller stated that this was not possible, however, the contactless payment feature could be disabled on the data subjects’ cards. The data subjects later filed a complaint because the debit cards contained the chips even if the contactless feature was disabled. The DPA dismissed the complaint in 2024, on the grounds that further investigation would be needed to determine whether the controller violated the GDPR or not. The DPA stated that it had limited capacity and such an investigation would pl

Related across sources

Enforcement Landlord: Insufficient legal basis for data processing Spanish Data Protection Authority (aepd) Enforcement MediaLab.AI, Inc.: Insufficient legal basis for data processing Information Commissioner (ICO) Enforcement Tensa Art Design S.A: Insufficient cooperation with supervisory authority Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) Enforcement GENPACT ROMANIA SRL: Insufficient technical and organisational measures to ensure information security Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) Enforcement Alliance for the Union of Romanians (AUR) Party: Insufficient fulfilment of data subjects rights Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP) Enforcement Municipality of Delft: Insufficient legal basis for data processing Dutch Supervisory Authority for Data Protection (AP)

Similar Content