DataGuidance - DataGuidance

ING Bank fined $5 million for GDPR violations in Poland. On August 26, 2025, the Polish data protection authority (UODO) fined ING Bank PLN 18.4 million (approximately $5 million) for violating the General Data Protection Regulation (GDPR). The investigation revealed that ING Bank scanned identity documents of customers and potential clients without lawful basis, violating Articles 5(1)(a), 5(1)(b), 5(1)(c), and 6(1) of the GDPR. The bank did not conduct individual risk assessments related to the Anti-Money Laundering (AML) Act, and documents were scanned in situations not required by the act.