The National Supervisory Authority for Personal Data Processing completed, in March 2026, an investigation into ING Bank NV Amsterdam – Bucharest Branch S.A., during which it found a violation of the provisions of Article 32(1)(b) and (d), Article 32(2), and Article 32(4) of Regulation (EU) 2016/679.

The controller was subject to an administrative fine amounting to RON 20,388 (equivalent to EUR 4,000).

The investigation conducted into the controller was initiated following the receipt of a complaint from a data subject concerning an alleged violation of data protection legislation.

Specifically, the complaint concerned the fact that an employee of ING Bank NV Focșani handed over the complainant’s bank account statements to a third party without the complainant’s consent.

During the investigation, it was established that the controller had failed to implement adequate and sufficient technical and organisational measures to ensure the confidentiality of the complainant’s personal data, which resulted in the generation and disclosure to a third party of a bank statement relating to the complainant’s current RON account. This constituted an unauthorised disclosure of the complainant’s personal data (first name, last name, address, IBAN account number, and transactions carried out) to a third party, thereby violating the provisions of Article 32(1)(b) and (d), Article 32(2), and Article 32(4) of the GDPR.

At the same time, pursuant to Article 58(2)(d) of Regulation (EU) 2016/679, the National Supervisory Authority also imposed a corrective measure, requiring the controller to ensure that its personal data processing operations comply with the provisions of the GDPR by implementing appropriate technical and organisational measures, including the periodic training of persons processing data under the controller’s authority (employees or contractors), in order to prevent the unlawful or unauthorised disclosure of data to third parties.

Legal and Communication Department

A.N.S.P.D.C.P