Warsaw court upholds UODO's PLN 18.4m fine on ING for ID scans

Warsaw court upholds UODO's PLN 18.4m fine on ING for ID scans

2 November 2026: The Voivodeship Administrative Court in Warsaw has dismissed ING Bank Śląski's complaint against a fine of PLN 18,416,400 imposed by Poland's data protection authority, UODO, for scanning the identity documents of customers and prospective customers in situations where anti-money laundering law did not require it. UODO announced the judgment, handed down on 23 October, and notes that the bank can still take a cassation appeal to the Supreme Administrative Court.

Not yet independently verified. We have read UODO's announcement of the judgment, not the judgment itself or the full 2020 decision, and it is not yet known whether the bank will file a cassation appeal. We will update this when it can be confirmed, and remove this note.

Copying IDs by default, not by risk

The case, DKN.5112.6.2020, turned on how the bank used the anti-money laundering rules. UODO found that ING scanned ID documents as a matter of routine, including in cases with no link to its AML duties, and gave a complaint about an ATM as an example. It had not carried out the individual risk assessment that the AML law expects before deciding that a copy of a document is needed.

That, the regulator held, breached the GDPR's core principles in Article 5(1)(a), (b) and (c), lawfulness, purpose limitation and data minimisation, and Article 6(1), which requires a legal basis for each processing operation. The court has now agreed with the decision.

What the ruling means for onboarding and KYC

The judgment matters well beyond one bank. Many firms in Poland, from lenders and telecoms to rental and marketplace platforms, copy an ID card or passport "just in case" and cite AML or know-your-customer duties as the reason. UODO's position, now backed by the court, is that AML law allows a copy where a documented risk assessment shows it is needed for that customer and that purpose, not as a blanket step for everyone who walks in or opens a complaint.

For a compliance or product team, that turns into three checks:

• every flow that captures an ID image should name the legal duty it serves and the risk it addresses;
• complaint, support and marketing flows should not reuse an onboarding step that captures documents;
• identity verification vendors should be configured to collect only what the risk tier needs, and their retention periods should match.

Two more decisions from the same week

UODO published two related items in the same days. It fined Wyższa Szkoła Logistyki, a logistics university in Poznań, PLN 64,652 after a file with the data of 964 students was exposed on the dean's office platform, where it was opened by 125 of 388 users and downloaded 361 times; the regulator faulted the university's risk analysis. It also recommended that organisations covered by Poland's national cybersecurity system report personal data breaches through the S46 Cyber Hub, under an agreement with the Minister of Digital Affairs from November 2025.

Sources

• UODO: WSA upholds the President of UODO's decision imposing a fine of over PLN 18.4 million on ING Bank Śląski (Polish), 2 November 2026
• UODO: decision on ING Bank Śląski, case DKN.5112.6.2020 (Polish), 2 November 2026