Complaint rejected. Heavy penalty for a well-known bank

The UODO's investigation into ING Bank Śląski revealed that the bank improperly scanned identity documents without a legal basis before the AML law changes in July 2018. After the law's amendment, the bank required scans for various actions, failing to conduct individual risk assessments for clients. UODO stated that scanning is only legal when necessary for AML compliance. The bank was found to have violated GDPR by processing personal data without justification, leading to a fine of 18,416,400 PLN. The bank plans to appeal the decision, asserting compliance with legal obligations.