The Warsaw Provincial Administrative Court confirmed a decision by the Polish authority sanctioning a bank for systematically digitizing its clients' identity documents without conducting an individual risk analysis justifying this measure under anti-money laundering legislation.

Facts and Context

The Polish Data Protection Authority (UODO) issued a decision, confirmed by the Warsaw Provincial Administrative Court on October 23, 2026, imposing a fine of 18,416,400 PLN (approximately €4,282,884) on ING Bank Śląski for breaches related to excessive data collection through systematic digitization of identity documents.

The case originated from an audit conducted by the UODO at the bank, aimed at examining the practices of digitizing identity documents of clients and prospects, implemented following an amendment to the anti-money laundering and counter-terrorism financing law (AML-CFT) on July 13, 2018.

Reasons for the Decision

• Obligation of lawfulness and data minimization (Article 5(1)(a), (b), and (c) of the GDPR and Article 6(1) of the GDPR): The authority found that the bank systematically digitized identity documents, including for operations not subject to AML-CFT legislation, such as a complaint regarding an ATM. The authority judged that the bank had not demonstrated the necessity of this generalized collection, merely invoking the AML-CFT law without conducting an individual risk analysis for each situation. According to the authority, copying identity documents is lawful under this law only if indispensable for applying financial security measures, which must be demonstrated case by case based on a risk assessment. In the absence of such justification, the systematic collection lacked a legal basis and violated the data minimization principle.

Authority's Decision

Consequently, the authority imposed a fine of 18,416,400 PLN (approximately €4,282,884) on ING Bank Śląski. To determine this amount, the authority notably considered the large-scale data processing, which requires a higher level of diligence, as well as the professionalism expected of a banking institution.

Lessons Learned

This decision reminds that:

• Invoking a legal obligation, such as AML-CFT legislation, does not exempt the data controller from respecting the data minimization principle and justifying the necessity of each processing operation.
• Data collection by copying identity documents must be based on an individual and documented risk analysis, demonstrating that this measure is indispensable to achieve the intended purpose, and cannot be systematized for all client interactions.
• Institutions processing data on a large scale, notably financial institutions, are subject to an increased diligence requirement and must demonstrate particular professionalism in applying data protection principles.