AEPD (Spain) - EXP202500113
From GDPRhub
| AEPD - EXP202500113 | |
|---|---|
 | |
| Authority: | AEPD (Spain) |
| Jurisdiction: | Spain |
| Relevant Law: | Article 32 GDPR |
| Type: | Complaint |
| Outcome: | Upheld |
| Started: | 10.01.2025 |
| Decided: | 10.10.2025 |
| Published: | 05.01.2026 |
| Fine: | 500.000 EUR |
| Parties: | ING Bank N.V |
| National Case Number/Name: | EXP202500113 |
| European Case Law Identifier: | n/a |
| Appeal: | Not appealed |
| Original Language(s): | Spanish |
| Original Source: | AEPD (in ES) |
| Initial Contributor: | RP |
The DPA fined a bank €500,000 for losing a customer’s documents when transporting them via a courier. The DPA held that the bank failed to ensure adequate security and proper supervision of its processor under Article 32 GDPR.
English Summary
Facts
A data subject tried to register as a joint account holder with the controller, ING Bank N.V., Spanish Branch. On 24 January 2023, the data subject received a form and instructions from the controller. They contacted the controller’s courier service as instructed and received a shipping label issued by Dynamic Express Courier S.L., a temporary processor used by the controller. On 26 January 2023, an employee of a subcontracted courier, Autoradio, collected an envelope from the data subject. The envelope contained the completed form, a copy of the data subject’s identity document, and the shipping label.
The controller did not receive the documentation. Between 2 and 16 February 2023, the data subject contacted the controller several times. The controller informed them that the documentation had not arrived and that inquiries with different courier companies were ongoing. Dynamic had not reported any incident during the contractual relationship, which complicated the controller’s investigation. The controller later confirmed the loss of the documentation and acknowledged that it had attempted unsuccessfully to locate the shipment through all involved providers. The controller ended its contract with Dynamic in February 2023, shortly after the incident.
On 9 June 2023, the data subject lodged a complaint with the Bank of Spain, which forwarded the complaint to the AEPD under the applicable administrative rules. During the investigation, the Spanish Data Protection Agency (AEPD) reviewed the contract between the controller and its processor. The contract included a data protection clause and a list of security measures. It also set out situations in which penalties could be applied to the processor, but no penalties had been imposed because Dynamic did not report any incident. The AEPD opened proceedings on 10 January 2025 to assess whether the controller had complied with its obligations under Article 32 GDPR, particularly regarding the supervision of its processor and the security of the processing operations involving physical documents.
Holding
The AEPD held that the controller violated Article 32 GDPR because it did not ensure adequate technical and organisational measures to protect the personal data handled by its processor. The AEPD found that the controller did not exercise sufficient supervision over Dynamic and did not verify whether the processor applied the agreed security controls. The loss of the documentation, the absence of any incident report from the processor, and the controller’s inability to trace the shipment showed shortcomings in the controller’s risk management and its oversight of processors.
The AEPD proposed an administrative fine of €500,000 for the infringement. Before the final decision, the controller chose to make a voluntary payment under Spanish Administrative Procedure Law. This reduced the fine by 20%, resulting in a final payment of €400,000.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Spanish original. Please refer to the Spanish original for more details.
1/43 • File No.: EXP202500113 RESOLUTION OF TERMINATION OF PROCEEDINGS DUE TO VOLUNTARY PAYMENT From the proceedings initiated by the Spanish Data Protection Agency and based on the following BACKGROUND FIRST: On January 10, 2025, the Presidency of the Spanish Data Protection Agency agreed to initiate sanctioning proceedings against ING BANK N.V., SPANISH BRANCH (hereinafter, ING). Having been notified of the initiation agreement and after analyzing the allegations presented, on August 6, 2025, the following proposed resolution was issued: << File No.: EXP202500113 Contents PROPOSED RESOLUTION OF SANCTIONING PROCEEDINGS...................2 BACKGROUND..........................................................................................................2 FIRST:.................................................................................................................2 SECOND:................................................................................................................5 THIRD:...............................................................................................................16 FOURTH:.................................................................................................................16 FIFTH:..................................................................................................................16 SIXTH:....................................................................................................................16 SEVENTH:................................................................................................................17 EIGHTH:..................................................................................................................20 NINTH:.................................................................................................................21 TENTH:..................................................................................................................21 PROVEN FACTS................................................................................................21 FIRST:...............................................................................................................21 SECOND:..............................................................................................................21 THIRD:...............................................................................................................21 FOURTH:.................................................................................................................21 FIFTH:..................................................................................................................21 SIXTH:....................................................................................................................22 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 2/43 SEVENTH:................................................................................................................22 EIGHTH:..................................................................................................................22 NINTH:.................................................................................................................22 TENTH:..................................................................................................................22 ELEVENTH:.............................................................................................................22 TWELFTH:..........................................................................................................22 THIRTEENTH:................................................................................................23 FOURTEENTH:...................................................................................................23 LEGAL GROUNDS.................................................................................23 I. Jurisdiction.........................................................................................................23 II. Procedure......................................................................................................23 III. Preliminary Issues..............................................................................................23 IV...............................................................................................................................26 Response to the Objections to the Commencement Agreement................................................26 V. Breach of Obligation. Security of processing...............................................36 VI. Classification of the infringement of Article 32 of the GDPR and qualification for the purposes of statute of limitations..............................................................................................................41 VII. Proposed sanction........................................................................................41 VIII. Corrective measures..........................................................................................45 PROPOSED RESOLUTION.................................................................................45 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 3/43 PROPOSED RESOLUTION OF SANCTIONING PROCEEDINGS Based on the actions taken by the Spanish Data Protection Agency and on the following BACKGROUND FIRST: On June 20, 2023, a complaint was filed with the Spanish Data Protection Agency. The complaint, filed by the complainant with the Bank of Spain on June 9, 2023, was forwarded by this entity in compliance with Article 14 of Law 40/2015, of October 1, on the Legal Regime of the Public Sector. The complaint alleges a possible infringement attributable to ING Bank N.V., Spanish Branch, with Tax Identification Number W0037986G (hereinafter, ING or the respondent). The facts brought to the attention of this authority are as follows: The complainant states that, on January 19, 2023, they attempted to register as a joint account holder on their partner's bank account through the ING website. After several unsuccessful attempts, the complainant contacted the aforementioned bank, which indicated that it would send an email with instructions on how to complete the process in person rather than online. On January 24, 2023, after receiving and completing the form to register as a new party with an ING bank account, the claimant, following the instructions on the form, called ***PHONE.1 to contact the collection service. That same day, they received the shipping label via email. The label was sent by the transport company DYNAMIC EXPRESS COURIER S.L. (hereinafter, DYNAMIC). On January 26, 2023, an employee of TRANSPORTES AUTO-RADIO, S.A. (hereinafter, AUTORADIO) went to the claimant's address and collected an envelope containing the new party registration form, a photocopy of their ID, and the completed shipping label. Having received no updates, on February 2, 6, and 10, 2023, the claimant contacted ING to inquire whether the bank had received the submitted documentation. On all three occasions, they were informed that it had not been received, and, furthermore, on the 10th, they were told that the documentation would be requested from the shipping company. On February 13, 2023, the claimant contacted ING again, and ING confirmed that they were still awaiting confirmation from the shipping companies. The bank also recommended uploading the delivery note to the ING website: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 4/43 to request the shipment again and to file an incident report on the ING platform. Furthermore, on that same day, the claimant contacted AUTORADIO, the company responsible for collecting the documentation on January 26, 2023. AUTORADIO provided a shipment tracking number (***REFERENCE.1) and informed the claimant that the documentation had arrived at SENDING TRANSPORTE Y COMUNICACIÓN, S.A. (hereinafter, SENDING) in Madrid. They also advised the claimant to contact SENDING to inquire about the status of the documentation. The claimant then contacted SENDING, which confirmed that the documentation had arrived at their offices in Madrid, but did not know why it had not yet been sent to ING. SENDING indicated that they would file a claim with DYNAMIC. On February 16, 2023, the claimant contacted SENDING again, who informed them for the first time that they did not know the location of the documentation. SENDING stated that it was not in their offices and therefore might be in the possession of DYNAMIC. That same day, the claimant contacted DYNAMIC, who confirmed that they had not received the shipment from SENDING. After contacting SENDING again, DYNAMIC confirmed that they did not know the location of the documentation. On February 18, 2023, the claimant received an email from ING informing them that they had not received the necessary documentation to complete the process and urging them to submit it again. In response to this communication, the claimant demanded that ING clarify what had happened to the documentation containing their personal data, which had been sent to ING following their instructions. Finally, on March 6, 2023, a complaint was filed with the Civil Guard regarding the loss of documentation. The following was submitted with the complaint: - A copy of the ING new participant registration form, completed by the complainant. The form includes the following handwritten information: - Name, surname, ID number, account number, and signature of the complainant's partner. - Name, surname, ID number, date of birth, country of birth, nationality, country of tax residence, email address, mobile phone number, employment details, address, and signature of the complainant. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 5/43 In addition, the instructions for registering a new participant are included, consisting of: - “Fill in and sign the fields with a white background”; or “Call ***PHONE.1 and we will collect it for free” or “The new party involved must personally show their ID and give a copy to the courier.” or “VERY IMPORTANT! Check that your ID is valid (not expired) and give a photocopy to the courier. If you do not have an ID, see the back.” Furthermore, according to the document, the data controller for the personal data contained therein is ING. - Copy of the email received by the claimant from ***EMAIL.1 on January 24, 2023, at 11:31 a.m. with the document “ING identification label.pdf,” as well as a copy of the collection label completed by the claimant, which includes the ING and DYNAMIC logos. It states, “ATTENTION, the customer must identify themselves with their ID. The customer's signature must be the same as or match the one on their ID.” The following information is also included as required data for the collection request: name, surname, date, ID number, ID expiration date, and signature. - Delivery note for the collection order of the documentation dated January 26, 2023, from AUTORADIO, which includes, among other things, a collection number, the collection date, the name, surname, and postal address of the claimant (identified as the collection client). It also lists ING Direct-Alta as the "destination"; RECOGIDAS SENDING VIGO as the billing client; and 900-SENDING as the ordering party. - Copy of shipment tracking document ***REFERENCE.1 (ref: ***REFERENCE.2) dated February 13, 2023, which states “January 26, 2023. 9:13 PM. In transit. 6:56 PM. Service created in the system. Vigo (361). Sender: ***SENDER.1. Recipient: 900- SENDING. - Email exchange between the claimant and ***EMAIL.2 on February 18 and 20, 2023, in which ING requests the resending of the documentation, as it has not been received. The claimant responds, expressing their dissatisfaction with the situation, reiterating the chronology of events, and requesting clarification regarding the loss of their personal data. Below is the email sent by ING to the claimant on February 18, 2023 at 9:28 a.m.: “We are contacting you regarding your request to register a new participant on your payroll/orange/mini account. We have verified that we do not have a record of receiving the registration form for a new participant. For this reason, and in order to continue with the process, it is necessary that you send it to us again. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 6/43 This form is available on our website in your personal area, under the option: Documentation/My Forms/Everyday Accounts. You can submit it at any of our offices, or contact our courier service, whose telephone number appears on the form, which will collect it free of charge, or finally, send it by regular mail to the address (…). Remember that for the form to be valid, all fields must be correctly completed and the signature must be original and match the one on your identity document. Sincerely, The ING Team.” - Copy of the file generated as a result of the complaint of April 24, 2023 filed by the complainant against ING with the Municipal Consumer Information Office (OMIC) of the ***CITY COUNCIL.1. This file includes ING's response to the OMIC of May 16, 2023, which states, among other things: “(…) Firstly, this department sincerely regrets the inconvenience that the events you have described in your letter may have caused you, as well as the fact that the service provided by ING was not the most suitable possible. Similarly, we have learned that the courier company ***COMPANY.1 is reviewing its files again to confirm whether they finally received the documentation that was lost (...)”. - Report from the Civil Guard of ***CITY COUNCIL.1 reproducing the complaint filed by the claimant “for loss of objects or effects”. SECOND: In accordance with Article 65.4 of Organic Law 3/2018, of December 5, on Personal Data Protection and Guarantee of Digital Rights (hereinafter LOPDGDD), this complaint was forwarded to ING so that it could analyze it and inform this Agency within one month of the actions taken to comply with the requirements of data protection regulations. On September 15, 2023, ING, in response to the forwarding, made the following statements, which confirm The chronology detailed by the complainant: - No report has been issued by ING's Data Protection Officer following this complaint. However, the processing of personal data related to the collection, scanning, and receipt of our clients' documentation has been analyzed through a data protection impact assessment (DPIA) that has been reviewed and signed by ING's Data Protection Officer. The latest version of this DPIA is attached, as well as a copy of the full DPIA report, which contains a more comprehensive impact assessment, given that this processing could affect the rights and freedoms of our clients (...). - Several attempts were made by ING to locate the lost documentation after receiving notification from the complainant. Specifically, after receiving a call from the complainant on February 6, on February 8, 2023, information was requested from the company they had contracted C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 7/43 the company responsible for scanning all documentation received through the various entry channels (***COMPANY.2) was contacted. On February 9, a response was received from this company informing them that the documentation had not been received. - Furthermore, after urging the complainant to upload the collection slip, on February 13, 2023, information was requested from COMPANY.1, a courier service provider with which ING worked, which is not related to DYNAMIC, the company that collected the documentation. - Following the transfer of the complaint by the Spanish Data Protection Agency (AEPD), ING verified that the request for information from ***COMPANY.1 was made erroneously, without requesting information from DYNAMIC regarding the lost documentation until September 1, 2023. Specifically, it states: “(…) After receiving this request for information, ING reviewed the case again and requested information from its courier providers about the lost document. We have verified that in the previous interactions, information was requested from ***COMPANY.1, as it is the courier service company with which ING primarily works, and as it is known, these companies work with other entities that are part of their network. Therefore, it was probably understood that the entities Autorradio, Sending and Dynamic (entities referred to by A.A.A. in their complaint) were part of their network. Given that Dynamic was not contacted directly at that time for the reasons explained above, they have been requested to provide information about said document, although, since the end of February of this year, this company no longer provides services to ING, as explained below. Attached to the report submitted as Document number 1, is a copy of the aforementioned email sent on September 1, 2023 (...). - Regarding the causes that, according to ING, led to the incident that gave rise to the claim: A.A.A. filed a claim because the Stakeholder Registration Form that it gave to a courier at the end of January 2023 has been lost. We do not know exactly what happened between the companies that make up the courier network used by Dynamic, since ING is not part of it and its procedures and protocols are defined and are the sole responsibility of said courier companies. However, we understand that the cause was a one-off human error, since the loss of the documentation that these companies must deliver to us is not a common occurrence, given the considerable volume of documents received through this channel. The underlining is from the Spanish Data Protection Agency (AEPD). - Regarding the relationship between DYNAMIC and ING, it is noted: “(…) The courier company Dynamic provided services to ING on an occasional basis for a short period of time. Specifically, until an RFP process was initiated to select a new courier service provider, due to one of the two courier companies with which ING collaborated having entered bankruptcy proceedings. A contract was formalized with Dynamic, dated September 1, 2022, which was terminated on February 28, 2023. (…) Dynamic has informed us, following this request made by ING, that said document was indeed lost, which we understand probably due to a single instance of human error. - Furthermore, regarding the measures adopted to prevent If similar incidents occur, ING states: “(…) from the perspective of contractual actions, we understand that it is not necessary to take any measures because ING already has service level agreements and penalties in its contracts with the courier companies with which it collaborates, stipulated for the event that services are not provided adequately. Furthermore, and prior to receiving this complaint, ING has modified the contracts formalized with its courier companies to regulate their status as data controllers of the personal data of users that these entities collect as a result of providing courier services (document collection and delivery), in accordance with the Agency's rulings on this matter.” - Finally, it concludes: “ING regrets the events that occurred and that the lost document could not be located through the courier companies involved. However, we understand that the form was lost due to a one-off error by the courier company and, therefore, unintentionally, as this type of situation is not common in our daily operations. At ING, we have taken all possible steps to locate the document, unfortunately without success, and have informed A.A.A. of its loss and the need to submit it again if they still wish to register as a joint account holder on the bank account. Notwithstanding the above, according to the Agency's rulings, these courier companies are responsible for the services they provide to their clients and also for the processing of the personal data of their service users. Even so, as mentioned above, ING has taken all possible steps to try to locate the lost document and promptly inform A.A.A. of the actions taken and their outcome.” The underlining is by the Spanish Data Protection Agency (AEPD). The following documents are attached to their written response to the transfer: - Screenshot of incident number ***REFERENCE.3, which appears in the complainant's history, detailing the actions taken by ING following the various notifications made by the complainant regarding the lost documentation. The incident was created on February 6, 2023, at 1:23 p.m. with the following text: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 9/43 “Client calls because on January 26, the registration form for the B.B.B. account was collected by courier by the company AUTORADIO.” The information the customer has on the receipt they received is: Collection number ***REFERENCE.4, courier name C.C.C., the customer has a tracking code ***REFERENCE.1 and when they check the courier's website, it shows that it has been in transit since January 26th. Please file a claim with the courier (...)”. On February 8, 2023, at 2:29 PM, the following comment appears: “We sent an inquiry to the supplier with the information provided.” On February 9, 2023, the incident history shows: “We have a response from ***COMPANY.2 and the documentation has not been received. Please request a new shipment.” Thank you.” On February 13, 2023, at 5:02 PM, the comment reads: “Entered via pilot inquiry. We request the client to submit the document delivery note so we can file a claim with the courier.” At 5:15 PM: “Received inquiry from the client… indicates they have uploaded the courier document to their personal area.” Meanwhile, on February 14, 2023, at 2:12 PM, the comment states: “We still cannot locate the FAI (Individual Taxpayer Identification Number) using either the TIT (Taxpayer Identification Number) or the client's information. We are contacting the supplier again to confirm the document delivery. We await their response.” On February 16, 2023, at 11:40 AM, the comment in the incident history states: “The documentation has not been located by either COMPANY.2 or COMPANY.1.” Please request that you resend it to us.” Finally, on February 18, 2023, at 9:32 a.m., the incident was closed with the following observation: “We requested FAI again… we are closing.” - Copy of the CAR RADIO collection slip uploaded to the ING platform by the claimant on February 13, 2023. - Copy of the email sent by ING to DYNAMIC on September 1, 2023, requesting information about the missing documentation. This communication states: “(…)”. - Copy of the service agreement between ING and DYNAMIC, valid between September 1, 2022, and February 28, 2023, and therefore in effect at the time when the events described in the first factual background took place. In the Likewise, a section on the protection of personal data is included, identifying ING as the data controller and DYNAMIC (the supplier) as the data processor. The contract, regarding data protection, states verbatim (emphasis added by the Spanish Data Protection Agency): “(…)” C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 10/43 For its part, ANNEX IV - SECURITY MEASURES establishes the following measures: (…) Furthermore, ANNEX V - SERVICE LEVEL AGREEMENT states (emphasis added by the Spanish Data Protection Agency): “(…)”. The following penalties are established in the event of non-compliance by the supplier, referring only to possible delays in the collection of documentation. “(…)” - Contract termination letter sent by ING to DYNAMIC on February 13, 2023, expressing its intention to terminate the contract effective February 28, 2023. - Letter dated September 14, 2023, sent by ING to the claimant, confirming the loss of the documentation and reiterating its apologies for what happened. - Impact assessment on the management of physical and digital documentation (reduced and full versions). THIRD: On September 19, 2023, in accordance with Article 77 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), ING was asked to clarify the penalties applied to DYNAMIC, as the data processor in this specific case, in light of the response provided regarding the measures adopted to prevent incidents. Similar cases. On September 28, 2023, a new response was received indicating that no penalties were applied, since “during the term of the contract, no incidents were reported that would justify the application of penalties under the terms stipulated in the contract, according to the information available to us at ING. The incidents that would justify penalizing the supplier are those that constitute errors directly attributable to them, such as the collection of documentation outside the deadlines specified in the table in Annex 4 of the contract or its loss, for example. (…) Therefore, the events that prompted the claim (loss of the document) were not reported by Dynamic to ING as a case of lost documentation during the period of the contractual relationship between the two entities.” In this regard, in the Excel tracking file for January 2023, in the column where possible incidents were coded, no incidents were reported. It is also important to clarify that when ING became certain that the document loss occurred within the Dynamic service provision environment, this entity no longer had a contractual relationship with C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 11/43 Dynamic, which was terminated in February, as stated in the initial allegations submitted.” FOURTH: On September 20, 2023, in accordance with Article 65 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights), the complaint was admitted for processing. FIFTH: On January 10, 2025, the Presidency of the Spanish Data Protection Agency (AEPD) agreed to initiate sanction proceedings against the respondent, pursuant to Articles 63 and 64 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP), for the alleged infringement of Article 32 of the GDPR, as defined in Article 83.4.a) of the GDPR. SIXTH: On January 13, 2025, the aforementioned initiation agreement was notified in accordance with the rules established in Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter, LPACAP). On January 14, 2025, the respondent submitted a document requesting a copy of the file, as well as an extension of the 10-day period granted for submitting arguments against the initiation agreement. On January 15, 2025, the extension of the period for a maximum of 5 days was granted, in accordance with the provisions of Article 32.1 of the LPACAP, and a copy of the file was sent to the respondent pursuant to Article 53.1 a) of the same law. Following the aforementioned extension agreement, the deadline for the defendant to submit arguments against the initial agreement was February 3, 2025, inclusive. SEVENTH: On February 3, 2025, ING submitted a document with arguments against the initial agreement, which, in summary, stated the following: 1. In the first argument, entitled “Regarding the Facts,” in addition to recounting the facts established in the initial agreement, it states: - With regard to DYNAMIC, it asserts that DYNAMIC became part of ING's group of courier providers on a temporary basis and that it “only provided courier services for 5 months, to meet an increase in one-off courier demand.” - It asserts that DYNAMIC failed to comply with the established reporting and tracking system and did not report the incident in January, which hampered the search conducted by ING during February and March. - Furthermore, it notes that ING acted diligently since, firstly, it contacted its main supplier “given that in the area where the collection of the Complainant's documentation takes place (province of Pontevedra), a majority of collections are carried out by ***COMPANY.1, ING, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 12/43 as part of its ordinary operations, it contacted this supplier first, in order to identify the shipment in question and expedite the location of the documentation.” It emphasizes that its main supplier is the postal operator organized into franchise networks with the largest number of partners in the Spanish market, while DYNAMIC is a postal service provider not affiliated with a large franchise network. Furthermore, it asserts that, due to the segmentation of the sector, it is common for several transport companies to be involved in a single shipment, or that in certain regional areas some sectors are divided in a certain way, or, if necessary, substitutions or delegations are made on a case-by-case basis between the operators themselves. Therefore, this review of the actual entities involved cannot be identified as a lack of diligence on the part of ING, but rather reflects the operational reality of the sector. - It points out that the incident represents only 0.0029% of the total collections and shipments of documentation for ING customers, and therefore considers the measures deployed to be adequate for the remaining 99.9% of cases. 1. In the second allegation, entitled “Regarding the adequacy of the security measures,” ING states that “although the measures implemented (both before and after) by ING were already listed in this party’s responses to the various information requests,” the following measures were included: o Adoption of a Data Protection Act (DPA), pursuant to Article 30 of the GDPR. o Impact assessment pursuant to Article 35 of the GDPR. o Formalization of a contract with DYNAMIC in accordance with Article 28 of the GDPR, which includes the security measures already detailed in the background information, including those corresponding to Annex IV reproduced above. Furthermore, it emphasizes that the contract contained a Service Level Agreement (SLA) in its Annex V, which stipulated that “in the event of non-compliance with the regulations, ING will be informed immediately, as well as the measures it will take to restore the agreed service levels and the implementation deadlines.” It underlines that “specifically, a 24-hour period is established for the delivery of the documentation collected by DYNAMIC. Therefore, the expiration of this period without the delivery is categorized as an incident, which must be reported to ING immediately. In this way, ING carried out effective monitoring, which also entailed a possible penalty in case of non-compliance (a 15% penalty for the existence of 2% of incidents, defined as the absence of delivery within the 24-hour period).” It asserts that, during the provision of the service, a periodic reporting system was established for the purpose of monitoring and tracking the execution of the service: “when these resulted in an incident or a failed collection, as evidenced in DOC 1 Files.pdf already submitted to the file, which includes the report C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 13/43 relating to the submission of documentation by the Complainant.” This would demonstrate, it asserts, that there were indeed, it points out, measures aimed at ensuring traceability and knowing the status of deliveries implemented by ING. It adds that “in addition to the measures stipulated by ING, DYNAMIC provided, as a measure for traceability and tracking of shipments, an application that allowed the user or client of ING to track the delivery by entering the order number on its website. This measure was used by the Complainant, as evidenced in the screenshot attached below, from the interaction report already provided by ING during the request phase.” or It conducts periodic reviews of the contractually adopted measures and has an annual monitoring plan based on which suppliers of different types are selected. - It concludes that the above demonstrates that it had sufficient measures in place, which, moreover, are the “standard used in the courier services sector regarding the control and tracking of shipments and collections,” and that “zero risk” does not exist and is therefore not required of ING, as can be seen from the Judgment of the Administrative Chamber of the National Court, in its Section 1, of December 23, 2013, Appeal No. 341/2012. 1. In the third allegation, entitled “on the role of the data controller and the associated responsibility,” it states that DYNAMIC would be the data controller pursuant to Article 28.10 of the GDPR insofar as ING had established measures for monitoring and tracking the collection and shipment of documentation and that DYNAMIC had an obligation to submit periodic reports, but failed to comply with this obligation. Therefore, DYNAMIC did not report the loss of the documentation at any time and acted in violation of the instructions of the data controller. Therefore, it would be this entity that would have violated Articles 28, 33, and 82 of the GDPR. 2. In the fourth allegation, entitled “Regarding the lack of evidence of fault or negligence by ING,” the respondent: - Insists that it had adequate measures in place, as explained in its second allegation. - Also states that the documentation was in a sealed envelope, therefore, there was no breach of confidentiality, as there is no evidence that the documentation contained in the envelope was accessed by unauthorized third parties. - Furthermore, presents specific cases in which, in its view, the actions of the Spanish Data Protection Agency (AEPD) would have been different from the case presented regarding the attribution of infringements to data controllers. - It asserts that the principle of presumption of innocence has not been applied and that there is no evidence that the claimant has suffered any harm, the proof of which, in its view, is that its partner continues to hold the account with its entity. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 14/43 1. In the fifth allegation, “Regarding the inadmissibility of strict liability,” it emphasizes that this is an individual error on the part of the data processor and that the measures included in the contract have not been taken into account by the Spanish Data Protection Agency (AEPD). It also reproduces excerpts from Supreme Court Judgment 188/2022 of February 15, 2022, to indicate that the GDPR establishes an obligation of means, not of results. 2. Finally, in the sixth allegation regarding “The lack of proportionality of the infringement,” it states that, while it considers its actions to have been diligent and that, therefore, the initiation of sanction proceedings is not warranted, should the Spanish Data Protection Agency (AEPD) consider that there has been any infringement, it must be assessed that the amount of the initially imposed sanction is excessive insofar as, in its opinion: - It only affects two people. - It does not appear that the documentation has been made available to unauthorized third parties. - ING has never been sanctioned under Article 32 of the GDPR; moreover, it has never been sanctioned in matters of data protection. - It is an incident that represents 0.0029% of those collected. - The actions taken by ING to identify the supplier responsible for the collection cannot be considered a breach because it involves consulting all suppliers to resolve the matter. In this regard, they cite other sanctioning procedures initiated by the Spanish Data Protection Agency (AEPD) against other entities. - Regarding the circumstances of Article 83.2 of the GDPR as set out in the initiation agreement: Regarding intent or negligence: they reiterate that DYNAMIC is responsible for failing to provide the required notification. Regarding the affected data: they state that the data is not covered by Article 9 of the GDPR and is not considered sensitive because it was in a sealed envelope. Regarding the connection between their activity and the processing of personal data, they assert that, while ING does process personal data, "the collection and transport of documentation does not constitute ING's main activity, nor a complementary or regular activity to its main activity, and therefore does not affect all ING customers, constituting a residual practice within the financial institution's operations." - Furthermore, they point out that the following should have been considered as mitigating factors: The absence of prior sanctions (Article 83.2 e) of the GDPR). The processing of data without special categories (Article 83.2 g) of the GDPR). The degree of cooperation with the Spanish Data Protection Agency (Article 83.2 f) of the GDPR). Adherence to codes of conduct or certification mechanisms (Article 83.2 j) of the GDPR). In this regard, it states that it “has a system of compliance and prevention of criminal risks certified externally, as stipulated in Article 31 Bis of the Criminal Code. This system was reviewed in 2019 by the entity ERNST & C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 15/43 YOUNG, S.L., both the “Compliance and Prevention of Criminal Risks Model” and the “Money Laundering Prevention Model”. or The non-existent benefit (Article 83.2 k) of the GDPR). EIGHTH: On February 25, 2025, ING sent a letter in which it communicated, among other aspects, the following: “(…) The contracting of DYNAMIC with ING in September 2022 stems from the termination of the service provision contract with the previous supplier, which required a temporary contract (specifically, the period was 6 months) until the service provision could be covered indefinitely. During those six months, ING issued a Request for Proposal (RFP) to select a permanent supplier, which was ultimately awarded to the entity (…) The only subcontractor authorized by ING to provide services to DYNAMIC (…) . With the exception of this one, DYNAMIC has not informed ING of the involvement of any additional supplier (...)”. NINTH: According to information available on ING.es (https://www.ing.es/sobre-ing/sala- prensa/resultados-anuales-2022), ING Spain and Portugal added 256,000 new customers in 2022. During 2023, ING surpassed 3,000,000 customers and added 330,000 new customers (ing.es/sobre-ing/sala-prensa/ing-impulsa-su-crecimiento- resultados-anuales). TENTH: A list of documents included in the proceedings is attached as an annex. From the actions carried out in these proceedings and the documentation in the file, the following have been established: PROVEN FACTS FIRST: ING and ING entered into a document collection services agreement, with its corresponding engagement agreement, valid between September 1, 2022, and February 28, 2023. According to this agreement, ING, the data controller, entrusted DYNAMIC with the collection of documents from ING's clients, after the client scheduled an appointment with the courier company. SECOND: Within the framework of the aforementioned agreement, on January 24, 2023, the claimant, an ING client, following the instructions provided by ING, arranged for the collection of documents related to their registration as a new participant in a bank account. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 16/43 On the same day, they received a shipment identification label from DYNAMIC. On January 26, 2023, AUTORADIO, a DYNAMIC partner, collected the documentation from the claimant's address. THIRD: On February 2, 6, 10, and 13, 2023, the claimant contacted ING to inquire whether they had received the submitted documentation. FOURTH: On February 6, 2023, following another call from the claimant, ING opened an incident report in their systems, recording the company name, collection number, courier name, and package tracking number provided by the claimant. FIFTH: On February 8, 2023, ING contacted ***COMPANY.2, responsible for receiving documentation on behalf of ING, to confirm whether the documentation sent by ING had been received. Claimant. Receives a negative response on February 9, 2023. SIXTH: On February 13, 2023, after the claimant's initial request for a copy of the delivery note, and following their insistence, ING contacted the courier company ***COMPANY.1 regarding the documentation. After the courier company refused to provide it, ING did not conduct any further checks with other parties who, given the nature of the service in relation to the signed contract, might have been responsible for the collection in question. SEVENTH: In the timeline of the incident opened by ING, an internal comment from February 9 and 16 indicates that the relevant department at ING should request the documentation from the client again, without any mention of a possible breach of personal data. EIGHTH: On February 18, 2023, ING confirmed the loss of the documentation and requested that The claimant must resubmit the documentation if they wish to continue with the registration process as a participant in a bank account. NINTH: The lost documentation contained the claimant's personal data, as shown on the submitted form (name, surname, ID number, date of birth, country of birth, nationality, country of tax residence, email address, mobile phone number, employment details, home address, and signature), and the personal data of the claimant's partner (name, surname, ID number, account number, and signature). Furthermore, the lost documentation included a complete copy of the claimant's ID, which had to be provided to the courier, in accordance with the instructions on the ING new participant registration form and the personal data recorded therein. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 17/43 given to the courier, in accordance with the instructions on the ING new participant registration form and the personal data recorded therein. the label. TENTH: On May 16, 2023, in response to a complaint filed with the Municipal Consumer Information Office (OMIC) of the City Council by the complainant, ING informed them that they had contacted the company again to inquire about the missing documentation. ING did not consult with other parties who, given the nature of the service in relation to the signed contract, might have been responsible for the collection in question. ELEVENTH: On September 1, 2023, after the complaint was forwarded by the Spanish Data Protection Agency (AEPD), ING contacted DYNAMIC for the first time to confirm whether the collection on January 26, 2023, at the complainant's address had been carried out by DYNAMIC or one of its collaborators. TWELFTH: The contract between ING and DYNAMIC included Annex IV, which established the security measures to be implemented by the data processor. Among the various measures were those aimed at physical security and cybersecurity, but no measures were included to ensure the traceability of document shipments. THIRTEENTH: The contract between ING and DYNAMIC included Annex V - Service Level Agreement, which stipulated penalties in case of non-compliance by DYNAMIC. However, ING did not take legal action against DYNAMIC for the loss of the documentation submitted by the claimant, even though this loss occurred during the term of the contract. FOURTEENTH: ING Spain and Portugal had a turnover of €1,091,000,000 in 2023, according to information available at ING.es (ing.es/about-ing/pressroom/ing-boosts-its-growth-annual-results). LEGAL BASIS I Jurisdiction In accordance with the powers granted to each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR) and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to initiate and resolve this procedure. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 18/43 II Procedure Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) establishes that: “The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures.” III Preliminary Issues Article 4.1 of the GDPR defines “personal data” as: “any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.” Article 4.2 of the GDPR defines "processing" as: "any operation or set of operations performed on personal data or sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction." In this case, in accordance with Articles 4.1 and 4.2 of the GDPR, the processing of personal data is evident, since DYNAMIC collects and stores personal data of the claimant who submitted documentation to the bank ING. The data processed includes name, surname, national identity card number, a copy of the national identity card, and postal address. DYNAMIC carries out this activity in its capacity as data processor, given that ING determines the purposes and means of the processing in accordance with Article 4.7 of the GDPR, while DYNAMIC processes (during the term of the contract) personal data on behalf of the data controller pursuant to Article 4.8 of the GDPR. Thus, in this case, ING is the data controller. As indicated, the GDPR establishes that the data controller is the entity that determines the purposes and means of the processing. In this regard, Article 4.7 of the GDPR states: “7) ‘controller’ or ‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing; (…)” (emphasis added by the Spanish Data Protection Agency). C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 19/43 For its part, the EDPB Guidelines 07/2020 emphasize that the concepts of data controller and data processor are functional concepts, and must be established based on their specific activities in the case under analysis and not on the formal designation that may appear in the contract: “12. The concepts of ‘data controller’ and ‘data processor’ are functional concepts: their objective is to assign responsibilities based on the actual role of each party. This implies that the legal status of ‘data controller’ or ‘data processor’ of the participants should, in principle, be established based on their specific activities in a given situation and not based on the formal designation of a participant as ‘data controller’ or ‘data processor’ (e.g., in a contract). This implies that the assignment of the role of controller or processor must normally derive from an analysis of the facts or circumstances of the case and, consequently, is not negotiable.” (emphasis added by the Spanish Data Protection Agency). Likewise, the aforementioned EDPB Guidelines 07/2020 advocate for a broad interpretation of the concept of data controller in order to promote effective and comprehensive protection of data subjects. In this regard, they stipulate: “14. Since the ultimate objective of assigning the role of data controller is to guarantee proactive accountability and effective and comprehensive protection of personal data, the concept of ‘controller’ should be interpreted broadly enough to promote, to the extent possible, effective and complete protection of data subjects, in order to ensure the full effectiveness of EU data protection law, avoid gaps, and prevent potential circumventions of the regulations, without diminishing the powers of the data processor.” (emphasis added by the Spanish Data Protection Agency). In addition to what has already been stated, it should be noted that these EDPB Guidelines highlight: “20. (…) The data controller is the one who decides certain essential aspects of data processing. Data controller responsibility can be established in the regulations or inferred from an analysis of the facts or the circumstances of the case. It is necessary to focus attention on the specific processing activities in question and understand who determines them. To do this, the following questions must first be examined: ‘Why does the processing take place?’ and ‘Who has decided that the processing should be carried out for a specific purpose?’” (emphasis added by the Spanish Data Protection Agency). For its part, as mentioned, DYNAMIC is a data processor: Article 4.8 of the GDPR states: “8) ‘processor’ or ‘processor’ means the natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;” (Emphasis added by the Spanish Data Protection Agency - AEPD). The EDPB Guidelines 07/2020 indicate two fundamental conditions for being considered a data processor: C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 20/43 “76. To be considered a data processor, it is necessary to meet two fundamental conditions: a) be an entity independent of the data controller; and b) process personal data on behalf of the controller.” (Emphasis added by the Spanish Data Protection Agency - AEPD) Both conditions are met in the case under analysis: On the one hand, DYNAMIC is an entity independent of ING (the data controller). On the other hand, DYNAMIC processes the data of ING's clients or potential clients and forwards the documentation submitted by them to ING. Furthermore, the processing of personal data of ING's clients or potential clients by DYNAMIC is carried out in accordance with ING's interests. As the European Data Protection Board (EDPB) has indicated in its Guidelines 07/2020, acting on behalf of someone means serving their interests: “80. Second, processing must be carried out on behalf of a controller, but not under their direct authority or control. Acting 'on behalf of' someone means serving the interests of another and refers to the legal concept of 'delegation'.” The aforementioned EDPB Guidelines 07/2020 highlight that nothing prevents the data processor (in this case, DYNAMIC) from offering a predefined service: “84. As previously stated, nothing prevents the data processor from offering a predefined service, but the data controller must make the final decision approving how the processing will be carried out, at least with regard to the essential means.” (emphasis added by the Spanish Data Protection Agency). In this case, the legal relationship between ING and DYNAMIC as data controller and processor, respectively, is established in the contract signed between them, valid from September 1, 2022, to February 28, 2023, which states that “(…)”. IV Response to the objections to the initial agreement First, it is appropriate to respond to the objections made by ING, which have been referenced in the background facts: 1. Regarding the first objection: - It is noted that, even if the relationship between ING and DYNAMIC took place for a short period of time, this does not exempt them from compliance with data protection regulations. In this regard, it is emphasized that the GDPR, in Article 28.1, establishes the obligation for the data controller to select a suitable processor, regardless of the duration of the relationship between them. However, the duration of the contract, insofar as it determines the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 21/43 duration of the infringement, must be taken into account when determining the amount of the fine. - Regarding the alleged non-compliance by DYNAMIC with respect to the reporting and monitoring system established by ING, and that this fact hindered ING's awareness of the incident, it should be noted that the aforementioned system established penalties in case of non-compliance by the supplier: ING asserts in its statement that the non-compliance should be understood as delays in the delivery of the collected documentation, which was to be done within 24 hours. It also established the following penalty: “more than 2% of incidents in the collections will be penalized with 15% of the unit cost of the affected collections.” However, on page 13 of its statement of allegations, it points out that the reporting system focused on incidents during the collection of the documentation, providing an illustrative table for this purpose. In this case, the collection took place on the scheduled date (January 26, 2023), and the incident occurred subsequently. However, according to ING, ING should have received the documentation on January 27, 2023, but did not. Nevertheless, ING did not detect this delay because it lacked early warning mechanisms that could have alerted it to a possible failure to meet the delivery deadline by its representative. Furthermore, it lacked traceability measures that would have allowed it to know which entity had collected the order and on what date, as well as the estimated delivery date. The system in place, according to ING's claims, required the person in charge to report incidents, without establishing any other form of control to ensure compliance, leaving this entirely in the hands of the person in charge. This again highlights the absence of any measures that would have allowed ING to verify and ensure proper compliance by its person in charge, through, for example, traceability measures for the documentation throughout the term of the contract between the two entities. In line with the above, it should be noted that, although DYNAMIC did not report the incident, ING became aware of it through the affected party, who first contacted the company to report the situation on February 2, 2023. However, the company did not generate an incident report in its system until February 6, 2023. The incident report already includes the name of the transport company that carried out the collection. However, ING was unable to identify its data controller until September 1, 2023, following the intervention of the Spanish Data Protection Agency (AEPD), despite prior notifications from the affected party, including a complaint filed with the Consumer Information Office (OMIC) in April 2023. In any case, as confirmed by ING, once the incident was discovered and the data controller was identified, no penalties were imposed or liability demanded against DYNAMIC by ING, even though the loss of personal data occurred during the term of the contract. Therefore, no breach was found. - Regarding the alleged diligent action by ING, given that its first reaction was to contact its main supplier - and not the person in charge of the collection, DYNAMIC C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 22/43 it is pertinent to recall the chronology of events: The affected party first contacted ING on February 2, 2023. The incident was not opened in the system until February 6, 2023. As indicated, the incident already included the name of the company that carried out the collection, the collection number, the tracking number, and the courier's name. On February 9, 2023, after receiving a negative response from the company centrally responsible for receiving the information (***COMPANY.2), the incident comment already indicated "request a new shipment." Contact with the main supplier did not occur until February 13, after another call from the affected party and after ING (11 days after the first call) requested a copy of the collection delivery note. Once a response was received from the main supplier, who confirmed that they could not locate the shipment, ING simply closed the incident and requested the affected party to resubmit the documentation. At no point was the affected party asked to send, for example, the collection label or the collection confirmation email from which ING could have obtained further information that would have allowed them to identify the person in charge. ING did not carry out any further investigation or verification until it received the complaint filed in April 2023 by the complainant with the Consumer Information Office (OMIC). Again, the only action taken by ING was to reiterate the inquiry to the same main provider. Finally, on September 1, 2023, after the complaint was forwarded by this Agency, ING contacted DYNAMIC to verify if they were the designated representative responsible for collecting the documentation. This demonstrates that ING was unaware of the designated representatives—who act on behalf of the responsible party—who, based on the type of service contract signed, could have been responsible for collecting the documentation, not at the complainant's address, but on a specific date and in a specific location. - Furthermore, regarding your assertion that the segmentation of the sector makes it common for several transport companies to be involved in a single shipment, it should be clarified that this does not exempt them from complying with data protection regulations, especially if the dynamics of the sector are known to the data controller and, based on the identified risk, may require strengthening security measures accordingly, as well as adapting to the other requirements of the GDPR. - Finally, regarding the percentage that the incident represents in relation to the total shipments made by ING, it should be noted that the incident has revealed the lack of technical and organizational security measures appropriate to the risk on the part of ING, at least during the term of the contract in question, that is, from September 1, 2022, to September 28, C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 23/43 2023. This general lack of measures affects all document shipments made during that period. These facts are what led to the opening of the present sanctioning procedure. 1. Regarding the second allegation, entitled “On the adequacy of security measures” - With regard to the measures alleged by ING, it should be noted, firstly, that the preparation of a Data Protection Act (DPA), a Data Protection Impact Assessment (DPIA), or the signing of a data processing agreement are obligations of the controller prescribed, respectively, by Articles 30, 35, and 28 of the GDPR. Furthermore, as indicated in the initial agreement, it is the controller's responsibility to establish the necessary measures in the processing agreement in accordance with Article 32 of the GDPR. In this respect, it should be emphasized that, in accordance with Guidelines 07/2020 on the concepts of “controller” and “processor,” the EDPB allows freedom regarding the level of detail of the measures determined by the controller, provided that, in no case, can it be a mere reproduction of the GDPR. Furthermore, the measures must be appropriate to the risk and must establish, at least, the security objectives (based on the risk assessment of the responsible party). In this case, among the measures established, there is none related to guaranteeing the traceability of document shipments to know their precise location. Moreover, all the measures appear to be aimed at ensuring compliance with the objectives of data availability in information systems, cyberattacks, and the physical security of the packages and the facilities where they are stored. Regarding the references to Annex V of the contract, and the fact that its penalty system could be understood as a measure intended to guarantee traceability, we reiterate what was stated in the response to the first allegation. It is emphasized, in any case, that ING presents an example of the “periodic reports” that DYNAMIC was required to send. As indicated in its own allegations, “the reports were made in documents that identified each of the collections carried out by DYNAMIC for ING (…). Below, an illustrative screenshot of the content of the reports is provided.” The content of the report refers exclusively to the incidents that occurred during the collection of the documentation, specifying the following as incidents: “incomplete address, absent for the second time, absent (…).” From the above, it is evident that the objective of the reports was limited exclusively to the incidents that occurred during the collection. In this case, the collection took place without incident on the scheduled date. Furthermore, the fact that DYNAMIC had an application that allowed the client to track their documentation should not be confused with or equated with the existence of appropriate technical and organizational measures to guarantee a level of security commensurate with the risk required of ING, as the data controller, pursuant to Article 32 of the GDPR, and which allow ING to guarantee control of postal deliveries, establishing a viable system for verifying the traceability of the documentation sent, along with monitoring claims to ensure early warning of potential personal data breaches. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 24/43 - Regarding the periodic reviews of the measures adopted, as alleged by ING, it is emphasized that the GDPR itself establishes a new approach based on risk management, which is not static and, therefore, requires periodic assessments aimed at ensuring compliance with the GDPR as a whole, within the framework of the controller's proactive responsibility, recognized in Article 5.2 of the GDPR and developed in Article 24 of the GDPR. Furthermore, regarding the annual monitoring plan on which suppliers are selected, which, according to ING, demonstrates the existence of security measures appropriate to the risk, it is emphasized that it is the controller's obligation, in accordance with Article 28 of the GDPR, to select a processor that provides sufficient guarantees to implement appropriate technical and organizational measures to ensure that the processing complies with the provisions of the GDPR. Finally, ING asserts that it had the industry standard for measures regarding courier services and that the absence of zero risk precludes demanding absolute infallibility of the measures. In this regard, reference should be made to the SAN ruling of October 29, 2024, rec. 1824/2021, which states: “…it must be emphasized, in relation to the technical and organizational measures, that this is not merely a formal requirement, but a substantive one. In this sense, and in line with what has been stated above, as the Supreme Court ruling of February 15, 2022 (Appeal No. 7359/2020) points out, “It is not enough to design the necessary technical and organizational means; their correct implementation and appropriate use are also necessary, so that liability will also apply to the lack of diligence in their use, understood as reasonable diligence considering the circumstances of the case,” which does not imply that an obligation of result is required.” Along the same lines, the CJEU judgment of 14 December 2023, Natsionalna agentia za prihodite, Case C-340/21, EU:C:2023:986: “[The adoption of security measures regarding the protection of personal data] is not fulfilled by adopting just any measure, since they must be those necessary to guarantee the objectives set out in the provision, and of course, the formal approval of the security measures is not enough, as it is required that they be established and put into practice effectively. We have therefore considered that an obligation of result is imposed, consisting of adopting the necessary measures to prevent data from being lost, misplaced, or ending up in the hands of third parties. In short, every data controller (or data processor) is, by legal provision, liable for data security and must ensure that such measures or mechanisms are in place.” are effectively implemented in practice.” Similarly, the Supreme Court ruling of February 15, 2022 (Appeal No. 7359/2020) states that: “(…) it is not enough to design the necessary technical and organizational means their correct implementation and appropriate use are also necessary, so that liability will also apply to a lack of due diligence in their C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 25/43 use, understood as reasonable diligence considering the circumstances of the case.” From the above, it can be concluded that compliance with Article 32 of the GDPR requires not only the adoption or design of security measures appropriate to the risk, but also their proper implementation and monitoring. It is also worth mentioning Constitutional Court Judgment 94/1998, of May 4, in which the Constitutional Court stated that we are dealing with a fundamental right to data protection, which guarantees individuals control over their data, any personal data, and over its use and purpose, to prevent its illicit trafficking or use that is harmful to the dignity and rights of those affected; thus, the right to data protection is configured as a power of the citizen to object to certain personal data being used for purposes other than those that justified its collection. Therefore, the risk-based approach and the flexible risk model imposed by the GDPR—based on the dual configuration of security as a principle relating to processing and an obligation for the controller or processor—does not in any case require the infallibility of the measures, but rather their constant adaptation to the risk. 1. In response to the third allegation, entitled “Regarding the role of the data controller and associated responsibility,” which states that DYNAMIC would be responsible because it allegedly failed to fulfill its obligations, the following is noted: As stated in response to the previous allegations, it is the responsibility of the data controller to adopt the necessary security measures appropriate to the risk, whether these are preventive, detection, corrective, or improvement measures. Likewise, the data controller must provide the data processor with the security measures that the processor must follow or implement, whether in greater or lesser detail, but always indicating the security objectives pursued. In the present case, as noted, the instructions provided to DYNAMIC did not contain any mention of a traceability system that would allow ING to know the location of the documentation, but rather focused on aspects related to physical and IT security. On the other hand, the periodic reporting system was limited to incidents related to the collection of documentation. Furthermore, and regardless of the above, in any case, ING lacked early warning mechanisms to detect potential breaches of personal data, or to verify compliance and exercise control over its data controller. Moreover, ING became aware of the incident through the affected party, even though DYNAMIC did not inform them, and was unable to identify the data controller entrusted with collecting the documentation. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 26/43 2. Regarding the fourth allegation, entitled “On the lack of proof of guilt or negligence by ING”: - With respect to ING's reiteration that it had security measures appropriate to the risk, as stated in the second allegation, we refer you to the response to that allegation. It is emphasized, however, that the GDPR represents a new risk-oriented approach in which the proactive responsibility of the controller plays a central role. Thus, the controller will not only have to adopt measures and comply with the obligations to act or refrain from acting that the GDPR expressly or implicitly imposes, but will also have to be able to demonstrate at all times that the processing carried out is in accordance with the regulations. Article 32 of the GDPR represents a manifestation of the proactive responsibility obligations that the GDPR imposes on the controller and entails the requirement to adopt and implement security measures of all kinds to ensure a level of security appropriate to the risk throughout the entire lifecycle of the processing of personal data. - Furthermore, ING maintains that, since the documentation was in a sealed envelope, a breach of confidentiality could not have occurred, as there is no evidence that the documentation contained in the envelope was accessed by unauthorized third parties. In this regard, it is noted that a breach of personal data, according to the GDPR, can affect its availability, confidentiality, or integrity. Confidentiality implies access by unauthorized third parties, while integrity means that the data is corrupted or altered by unauthorized third parties. Availability, for its part, refers to the loss of data, as occurred with the personal data of the claimant. In any case, it is emphasized that in this proceeding, Article 32 of the GDPR is invoked, which refers to the adoption and implementation of security measures appropriate to the risk, capable of guaranteeing the confidentiality, integrity, and availability of personal data. ... - Regarding other AEPD resolutions referenced, it should be emphasized that the resolutions of this Agency are based on an analysis of the specific circumstances of each case, and in this particular case, the application of the principle of presumption of innocence is not deemed relevant, given the loss of the complainant's personal data, a fact acknowledged by the respondent, thus demonstrating the general absence of security measures appropriate to the risk at ING, at least during the term of the contract between ING and DYNAMIC. - In relation to the assertion that, in ING's view, no harm has been caused to the complainant, evidenced by the fact that their partner continues to hold an account with the bank, it is important to note that the right to data protection is a fundamental right constitutionally recognized in Article 18.4 of the Spanish Constitution. This fundamental right recognizes the right of citizens to control their data, whether or not this data has a constitutional dimension. The loss of the claimant's personal data constitutes in itself a C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 27/43 infringement of their fundamental right to data protection, regardless of whether or not the affected party's partner maintains their account with the entity being complained against. 1. Regarding the fifth allegation, “On the inadmissibility of strict liability”: - It is emphasized that, in general, the data controller is liable for the actions of its processor, insofar as the processor acts on behalf of the controller and in accordance with its instructions, as outlined in the preliminary matters of this document. Notwithstanding the foregoing, it is emphasized that, in the present case, the subject of these sanctioning proceedings is the lack of security measures appropriate to the risk faced by ING during the term of its contract with DYNAMIC, even though these measures came to light following the loss of documentation belonging to the complainant. Regarding the fact that the GDPR establishes an obligation of means and not of results, reference is made to the points raised in this respect in the response to the second allegation. 1. Regarding the sixth allegation entitled “On the lack of proportionality of the infringement,” which questions the proportionality of the fine: - Insofar as the incident only affected two people and represents a very low percentage of incidents compared to the total number of collections carried out by or on behalf of ING, it is reiterated that, although the claim was filed by a single claimant regarding specific events that affect him and his partner, as a result of the personal data breach, the absence of technical and organizational security measures appropriate to the risk on the part of ING has been demonstrated. These measures affect not only two people, but potentially all ING customers who used its courier service to send documentation (containing financial data) during the term of the contract with DYNAMIC. This element must be assessed in accordance with Article 83.2 a) of the GDPR. - Furthermore, as explained in the response to the fourth allegation, there are different types of personal data breaches, including availability breaches. - The fact that ING has not been previously sanctioned for data protection violations does not affect the fact that, in this case, a data protection violation has occurred, which must be sanctioned in accordance with current regulations. Moreover, while Article 83.2(e) considers any prior violation by the data controller as an aggravating circumstance, it does not consider the absence of a prior violation as a mitigating circumstance. - Furthermore, ING maintains that the actions taken to identify the supplier cannot be classified as a breach. However, it is emphasized that the relevant circumstance is the lack of control that the data controller has over its processors, as it was unaware of who was responsible for the service and did not contact DYNAMIC until September 2023, 7 months later and following the transfer of the complaint by the Spanish Data Protection Agency (AEPD), C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 28/43 all this despite the numerous occasions on which the affected party contacted ING to alert them about the situation. Regarding the examples of other sanctioning procedures resolved by the AEPD, it should be noted that, in accordance with Article 83.2 of the GDPR, fines must be imposed taking into account the circumstances of the individual case and that their amount, in each individual case, must consider the specific circumstances of the case. In this regard, Guidelines 04/2022 on the calculation of fines under the GDPR establish that the starting point for imposing fines will be determined according to three essential elements: the revenue of the defendant, the classification of the infringement in accordance with the GDPR, and its level of severity. - Regarding the allegations made by ING concerning the circumstances of Article 83.2 of the GDPR as set out in the initial agreement: o Regarding the absence of intent or negligence insofar as DYNAMIC did not alert ING about the loss of the documentation, the response to the allegations concerning the lack of notification by DYNAMIC and how the absence of an early warning system by ING has been demonstrated is hereby incorporated by reference. Furthermore, it is emphasized that ING did not take any action against DYNAMIC regarding these events and that, in its response to the complaint forwarded by the Spanish Data Protection Agency (AEPD), ING stated: “(…) DYNAMIC has informed us (…) that the document was indeed lost, which we understand was probably due to a single human error. (…) From a contractual standpoint, we understand that it is not necessary to take any action because ING already has service level agreements and penalties in place in the contracts signed with the courier companies with which it collaborates in the event that services are not provided adequately. (…) However, we understand that the loss of the form occurred due to a single error on the part of the courier company (…)”. Regarding the claim that Article 83.2(g) of the GDPR does not apply, since the personal data contained in the lost documentation did not correspond to those of Article 9 of the GDPR, it should be noted that Article 83.2(g) does apply in this case. Some of the personal data affected, even though they are not special categories of data as defined in Article 9 of the GDPR, are considered sensitive under Guidelines 04/2022 and are specifically named therein: bank account number or a full copy of the national identity document. In this respect, it should be emphasized that the national identity document, for example, allows for the direct and unambiguous identification of a natural person. As established by Royal Decree 1553/2005, the National Identity Document (DNI) is a general personal numerical identifier, with sufficient value to prove both the identity and nationality of the holder, which makes it a particularly sensitive element within the ecosystem of personal data. Furthermore, its misuse entails a high risk of identity theft, financial losses, or infringement of the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 29/43 right to honor, risks expressly contemplated in recital 75 of the GDPR. Furthermore, it cannot be overlooked that combining this type of personal data (ID number and bank account number, as well as with other types of data not considered sensitive) significantly increases the level of risk to the rights and freedoms of its holders. This is due to the fact that such a combination not only increases the amount of information available to a malicious actor, but also broadens the spectrum of potential abuses, since it is not a matter of isolated data or individual pieces of information, but rather the exposure of an integrated set of personal data that, when combined, can be used to build a complete and detailed profile of an individual. Regarding the application of the aggravating circumstance of Article 76.2 b) of the LOPDGDD (Spanish Data Protection Law), to which ING asserts that the transport activity is a residual activity and, therefore, its application is not warranted, it must be clarified that the initial agreement does not indicate that ING's main activity is the collection and transport of documentation, but rather that the performance of financial activities, which is ING's main activity, necessarily involves the processing of personal data of the natural persons who are clients (or potential clients) of said entity. Therefore, the infringement occurs within the framework of personal data processing that the controller routinely carries out in its business and which is closely linked to it. Regarding the allegation that the circumstances of Articles 83.2 e) and k) of the GDPR should have been considered as mitigating factors, it should be noted that, as indicated in the judgment of the National Court, of 05/05/2021, rec. 1437/2020, cannot be considered mitigating circumstances, circumstances that the regulation considers aggravating. Specifically, it states: “it considers, on the other hand, that the non-commission of a prior infringement should be considered a mitigating circumstance. Well, Article 83.2 of the GDPR establishes that the circumstance "(e) any prior infringement committed by the controller or the processor" must be taken into account for the imposition of the administrative fine. This is an aggravating circumstance; the fact that the prerequisite for its application is not met means that it cannot be taken into consideration, but it does not imply or allow, as the plaintiff claims, its application as a mitigating circumstance.” Applied to the case at hand, the lack of the prerequisite for its application with respect to Article 76.2.c) of the LOPDGDD, that is, obtaining benefits as a consequence of the infringement, does not allow its application as a mitigating circumstance.” The same applies to Article 83.2 f), without forgetting, moreover, that cooperation with the supervisory authority by the controller is an obligation under the GDPR. In this regard, the same judgment states: “with respect to the proposed application as a mitigating circumstance of circumstance f) of Article 83.2 of the GDPR 'the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate the possible adverse effects of the infringement', it suffices C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 30/43 to refer to what was stated in the Legal Basis to reject the application of said mitigating circumstance.” Furthermore, Article 83.2 g) cannot be used as a mitigating circumstance either, because, as explained, Guidelines 04/2022 expressly include personal data that go beyond those provided for in Articles 9 and 10 of the GDPR, which are applicable in this case. Finally, regarding the application of the mitigating circumstance contained in Article 83.2(j) of the GDPR, it should be noted that this article refers to the codes of conduct provided for in Article 40 of the GDPR, that is, in matters of data protection. Those alleged by the defendant refer to codes of conduct in the areas of criminal law and money laundering. Notwithstanding the foregoing, it should be emphasized that, in this case, when assessing the determining circumstances for imposing a fine, the duration of the contract between ING and DYNAMIC, which did not exceed six months, must be taken into account, in addition to the number of affected parties (both actual and potential), as one of the essential elements of Article 83.2(a) of the GDPR. This will foreseeably result in a reduction of the amount stipulated in the agreement. Initially. V Breach of Obligation. Security of Processing Article 32 of the GDPR stipulates the following: "1. Taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, which may include, among other things: (a) pseudonymization and encryption of personal data; (b) the ability to ensure the ongoing confidentiality, integrity, availability, and resilience of processing systems and services; (c) the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident; (d) a process for regularly testing, assessing, and evaluating the effectiveness of the technical and organizational measures to ensure the security of processing." " 2. When assessing the adequacy of the security level, particular consideration shall be given to the risks presented by data processing, especially those resulting from the accidental or unlawful destruction, loss, or alteration of personal data transmitted, stored, or otherwise processed, or from unauthorized disclosure of or access to such data. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 31/43 3. Adherence to a code of conduct approved pursuant to Article 40 or to a certification mechanism approved pursuant to Article 42 may serve as evidence of compliance with the requirements set out in paragraph 1 of this Article. 4. The controller and the processor shall take measures to ensure that any person acting under the authority of the controller or the processor and having access to personal data may only process such data on instructions from the controller, unless required to do so by Union or Member State law. In this regard, Recital 74 of the GDPR states that: “(74) The controller should be held responsible for any processing of personal data carried out by the controller or on behalf of the controller. In particularly, the controller should be required to implement appropriate and effective measures and should be able to demonstrate the conformity of processing activities with this Regulation, including the effectiveness of the measures.” These measures must take into account the nature, scope, context, and purposes of the processing, as well as the risk to the rights and freedoms of natural persons. For its part, EDPB Guidelines 7/2020 state that (emphasis added by the Spanish Data Protection Agency): "125. Article 32 requires the controller and the processor to implement appropriate technical and organizational security measures. Although this obligation is already directly imposed on the processor whose processing operations fall within the scope of the GDPR, the duty to adopt all necessary measures under Article 32 must be reflected in the contract relating to the processing activities entrusted to the processor." 126. As previously stated, the processing agreement should not simply reproduce the provisions of the GDPR: it must include or refer to information on the security measures to be implemented, the processor's obligation to obtain the controller's approval before making any changes, and a periodic review of the security measures to ensure their suitability to the risks, which may change over time. The level of detail in the information on the security measures to be included in the agreement must allow the controller to assess the suitability of the measures pursuant to Article 32(1) of the GDPR. This description is also necessary for the controller to fulfill its duty of proactive accountability under Article 5(2) and Article 24 of the GDPR regarding the security measures imposed on the processor. From Article 28, paragraph 3, letters (f) and (h), of the GDPR, the corresponding obligation of the processor to assist the controller and to make available to them all the information necessary to demonstrate compliance can be inferred. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 32/43 127. The level of detail in the instructions given by the controller to the processor regarding the measures to be implemented will depend on the circumstances of the case. In some cases, the controller may provide a clear and detailed description of the security measures that must be applied. In other cases, the controller may describe the minimum security objectives that must be achieved and request the processor to propose the application of specific security measures. In any case, the controller must provide the processor with a description of the processing activities and the security objectives (based on the controller's risk assessment), as well as approve the measures proposed by the processor. This could be included in an annex to the contract. The controller exercises decision-making power over the essential elements of the security measures, either by expressly indicating the measures or by approving the measures proposed by the processor. Therefore, Article 32 of the GDPR aims to guarantee a level of security appropriate to the risk, in relation to the processing of personal data, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as risks of varying likelihood and severity for the rights and freedoms of natural persons. Thus, the controller and the processor (in accordance with the instructions provided by the controller) will implement appropriate technical and organizational security measures to ensure this level of security appropriate to the risk. However, the obligation established in Article 32 of the GDPR implies, prior to having measures in place to prevent a potential personal data breach, but also being able to identify it as soon as possible and address it by adopting the necessary measures. necessary to mitigate their effects or put an end to them. Thus, Recital 87 of the GDPR suggests the obligation to have preventive and detection measures in place to avoid potential personal data breaches and, should these occur, to allow for their identification and subsequent correction as soon as possible: “87 It should be verified whether all appropriate technological protection has been implemented and appropriate organizational measures have been taken to determine immediately whether a data breach has occurred (…)” Along the same lines are Guidelines 9/2022, on the notification of personal data breaches under the GDPR, adopted by the European Data Protection Board (EDPB), when referring to the need to have measures in place to detect and remedy a potential personal data breach: “37. Therefore, the data controller must have internal processes in place to detect and correct a breach. For example, to identify irregularities in data processing, the C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 33/43 controller or processor may use certain technical measures, such as data flow and log analyzers, which can define events and alerts by correlating any log data. ... 41. Article 32 of the GDPR makes it clear that the controller and processor must have appropriate technical and organizational measures in place to ensure an adequate level of security for personal data: the ability to detect, address, and notify a breach in a timely manner must be considered an essential element of these measures. In the present case, the purpose of the contract between ING and DYNAMIC was the collection of documentation from clients or potential clients relating to a new registration as a participant in an account, a new registration as a client, or for matters relating to the granting of a premium loan, in accordance with the information contained in Annex V of the contract. Therefore, the documentation that was usually sent to ING via courier, in addition to requiring a complete copy of the national identity document, contained a variety of personal data. Thus, in the case of the claimant, who sent the required documentation for processing a new registration as a participant in an account, the personal data included in the The lost documentation included: name, surname, national identity card number, date of birth, country of birth, nationality, country of tax residence, email address, mobile phone number, employment information, home address, and signature. Among the minimum security measures required by ING from DYNAMIC in Annex IV of the contract, reproduced in the second factual background, there is no security measure related to guaranteeing the traceability of document shipments to know their precise location at all times. Furthermore, all the measures are intended to ensure the availability of the data in the information systems or to guarantee the physical security of the packages. In this regard, as previously indicated, it is the responsibility of the responsible party to verify that the measures implemented by the processor following their instructions are working, even though ING asserts that the protocols and procedures defined by the courier network are the "exclusive responsibility" of those companies, and even though the contract between the processor and The controller generically includes the obligation of the data processor to “(…)”. It is worth noting, and related to the above, that Article 24 of the GDPR, when addressing the controller's responsibility, states that “taking into account the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, the controller shall implement appropriate technical and organizational measures to ensure and be able to demonstrate that processing is compliant with this Regulation.” These measures will be reviewed and updated when necessary.” Furthermore, closely linked to the lack of traceability measures for shipments of documentation, it is striking that ING was unaware of the identity of the handlers or transport companies it was working with at that time, depending on C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 34/43 the location or collection area, for example, and that it lacked the precise information—which would allow the shipment to be traced from origin to destination—regarding the company responsible for a specific collection, if several options existed. In other words, when on February 6, 2023, the claimant alerted ING about the possible loss of its documentation and provided, according to the incident report, the name of the company that made the collection, the shipment tracking number, or even the name of the courier, the reaction ING's procedure involves verifying with the company responsible for managing the received documentation whether it has arrived. After receiving a negative response and following several calls from the claimant, it wasn't until February 13th that ING contacted the transport company to request the documentation. However, they contacted ***COMPANY.1 because it was "the most common" company, instead of DYNAMIC, the company responsible for collecting the documents in this specific case. As of May 16, 2023, ING persisted in its confusion, as demonstrated by the communication sent to the claimant on that date within the framework of the file generated as a result of the complaint filed with the Consumer Information Office (OMIC) of the City Council, in which they informed ***COMPANY.1 that information had been requested again. Therefore, the request for information from DYNAMIC, as the company responsible for collecting the lost documentation, was not made. until September 1, 2023, when the contractual relationship between the two parties had ended on February 28, 2023. Similarly, the documentation in the file reveals that ING lacked early warning measures that would have allowed for the identification and rapid detection of a personal data breach. While ING claims that its representative should have delivered the data within 24 hours of collection, when this did not occur, ING took no action because it was unaware of the delay. Likewise, it did not react when the affected party alerted them to the situation on February 2, even though the 24-hour delivery period from collection, as ING asserts, had been exceeded. On the contrary, it did not open an incident report until four days later, after another call from the affected party. Furthermore, in ING's internal comments regarding the resolution of the incident, both in the On February 9th and 16th, it was already indicated that the solution was to request the client to resubmit the documentation, which highlights that no further action was taken to determine what had happened and why, as well as the lack of a protocol for action in these cases. The above demonstrates that ING lacked, at least throughout the entire term of the contract with DYNAMIC, the effective adoption and implementation of appropriate technical and organizational measures to guarantee a level of security commensurate with the risk. These measures should have been aimed at ensuring control of postal deliveries, establishing a viable system for verifying the traceability of sent documentation, and, closely related to this, a claims tracking system that would allow for the rapid detection of personal data breaches. Similarly, ING also lacked measures such as measurements, periodic inspections of the delivery network, internal audits, test mail runs, or the implementation of internal or external panelists to determine the location of documentation. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 35/43 In short, as a result of the loss of the documentation submitted by the complainant through the channels officially established by the data controller, and regardless of this breach of personal data availability, it has been revealed that there were insufficient security measures in place as defined by Article 32 of the GDPR during the term of the contract between the data controller and its processor, specifically, traceability measures for document shipments, as well as early warning systems for incidents and potential personal data breaches. Therefore, in accordance with the evidence available at this stage of the proceedings, the known facts are considered to constitute an infringement, attributable to ING, for violation of Article 32 of the GDPR, as previously transcribed. VI Classification of the infringement of Article 32 of the GDPR and its classification for the purposes of the statute of limitations Article 83.4 of the GDPR classifies as an administrative infringement the infringement of the following article, which shall be sanctioned, in accordance with paragraph 2, with administrative fines of up to EUR 10,000,000 or, in the case of an undertaking, up to 2% of its total annual global turnover of the preceding financial year, whichever is higher: "(a) the obligations of the controller and the processor pursuant to Articles 8, 11, 25 to 39, 42 and 43;" For its part, the LOPDGDD, in its Article 71, Infringements, states that: “The acts and conduct referred to in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679, as well as those that are contrary to this Organic Law, constitute infringements.” For the sole purpose of determining the statute of limitations, Article 73 of the LOPDGDD establishes the following: "In accordance with the provisions of Article 83.4 of Regulation (EU) 2016/679, the following infringements are considered serious and shall be subject to a two-year statute of limitations: infringements that constitute a substantial breach of the articles mentioned therein, and in particular, the following: f) Failure to adopt the appropriate technical and organizational measures to ensure a level of security appropriate to the risk of the processing, as required by Article 32.1 of Regulation (EU) 2016/679." VII Proposed Sanction In order to determine the administrative fine to be imposed, the provisions of Articles 83.1 and 83.2 of the GDPR must be observed. These articles state: “1. Each supervisory authority shall ensure that the imposition of administrative fines under this Article for infringements of this Regulation, as indicated in paragraphs 4, 9, and 6, is effective, proportionate, and dissuasive in each individual case. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 36/43 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 36/43 C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 36/43 Each supervisory authority shall, in each individual case, take into account the circumstances of each individual case. 2. Administrative fines shall be imposed, depending on the circumstances of each individual case, as an additional measure to, or in lieu of, the measures provided for in Article 58(2)(a) to (h) and (j). When deciding on the imposition of an administrative fine and its amount in each individual case, due consideration shall be given to the circumstances of each individual case. Taking into account: (a) the nature, seriousness, and duration of the infringement, considering the nature, scope, or purpose of the processing operation concerned, as well as the number of data subjects affected and the level of damage suffered by them; (b) whether the infringement was intentional or negligent; (c) any measures taken by the controller or processor to remedy the damage suffered by data subjects; (d) the degree of responsibility of the controller or processor, taking into account the technical and organizational measures implemented pursuant to Articles 25 and 32; (e) any prior infringements committed by the controller or processor; (f) the degree of cooperation with the supervisory authority in order to remedy the infringement and mitigate its possible adverse effects; (g) the categories of personal data affected by the infringement; (h) how the supervisory authority became aware of the infringement, in particular whether the controller or processor notified the infringement. and, if so, to what extent; (i) where the measures referred to in Article 58(2) have been previously ordered against the controller or processor concerned in relation to the same matter, compliance with those measures; (j) adherence to codes of conduct pursuant to Article 40 or to approved certification mechanisms pursuant to Article 42; and (k) any other aggravating or mitigating factors applicable to the circumstances of the case, such as financial benefits obtained or losses avoided, directly or indirectly, through the infringement. For its part, Article 76, “Sanctions and Corrective Measures,” of the LOPDGDD (Spanish Data Protection Law) provides: “1. The sanctions provided for in paragraphs 4, 5, and 6 of Article 83 of Regulation (EU) 2016/679 shall be applied taking into account the criteria for determining the severity of the sanction established in paragraph 2 of said Article. 2. In accordance with the provisions of Article 83.2.k) of Regulation (EU) 2016/679, the following may also be taken into account: a) The continuing nature of the infringement. b) The connection between the infringer's activity and the processing of personal data. c) The benefits obtained as a result of committing the infringement. d) The possibility that the data subject's conduct may have induced the commission of the infringement. e) The existence of a merger by acquisition subsequent to the commission of the infringement, which cannot be attributed to the entity.” Absorbent. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 37/43 f) The impact on the rights of minors. g) To have, when not mandatory, a data protection officer. h) The voluntary submission by the controller or processor to alternative dispute resolution mechanisms, in those cases where disputes arise between them and any interested party. The above implies, according to Guidelines 04/2022 on the calculation of fines under the GDPR, that the amount of the fine must be based on three elements: the turnover, the categorization of the infringements according to their nature (i.e., whether it is an infringement of Article 83.4, 83.5, or 83.6 of the GDPR), and the level of seriousness of the infringement in each specific case (in accordance with Article 83.2 a), b), and g). In any case, the fine imposed must be, in each individual case, effective, proportionate, and dissuasive, as established in Article 83.1 of the GDPR. In any case, the fine must be, in each individual case, effective, proportionate, and dissuasive, as established in Article 83.1 of the GDPR. In this regard, the turnover of ING Spain and Portugal in 2023 is considered as a preliminary matter, at €1,091,000,000. Furthermore, taking into account the categorization of the infringement, in accordance with Article 83.4 of the GDPR, the penalty imposed for each infringement may be a maximum of €10,000,000, or, in the case of a company, an amount equivalent to a maximum of 2% of its annual turnover, whichever is higher. Two percent of ING's turnover is €21,820,000. Therefore, the penalty imposed must necessarily be between €0 and €21,820,000. Furthermore, regarding the level of severity under the GDPR, it is considered that the following circumstances apply: - The nature, severity, and duration of the infringement, taking into account the nature, scope, or purpose of the processing operation in question, as well as the number of data subjects affected and the level of damage they have suffered (Article 83.2(a) of the GDPR): notwithstanding that the sanctioning procedure is being initiated following a complaint, the known facts demonstrate a lack of security measures affecting all of its clients who used the messaging systems of its processor provided by ING during the term of its contract with DYNAMIC, whether for sending documentation related to a new registration as a party to an account, a new registration as a client, or for matters related to the granting of a premium loan, in accordance with the information contained in Annex V of the contract. Furthermore, it is emphasized that the documentation typically sent via courier services, in addition to requiring a complete copy of the ID card, contains a variety of personal data. Thus, in the case of the claimant, the affected data included: name, surname, ID number, date of birth, country of birth, nationality, country of tax residence, email address, mobile phone number, employment details, home address, and signature. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 38/43 It is noted that ING increased its number of customers by 256,000 in 2022 and by 330,000 customers in 2023. Furthermore, it is pointed out that the contract duration ran from September 1, 2022, to February 28, 2023, not exceeding 6 months. - Gross intent or negligence in the infringement (Article 83.2, letter b), of the GDPR): Negligence is found, insofar as the chronology of the actions carried out by ING since being alerted by the complainant of the possible infringement demonstrates a lack of due diligence on the part of the controller with respect to its processors, including their identity. Thus, ING did not contact DYNAMIC until September 1, 2023, even though it had all the information regarding the collection of the documentation since February 2023, as this information had been provided by the claimant. - The categories of personal data affected by the infringement (Article 83.2(g) of the GDPR): Guidelines 04/2022 of the European Data Protection Board on calculating fines under the GDPR, adopted on 24 May 2023, in paragraph 57, state the following regarding the requirement to take into account the categories of personal data affected: “(…) the GDPR clearly highlights the types of data that deserve special protection and therefore a stricter response with regard to fines. This refers, at a minimum, to the types of data referred to in Articles 9 and 10 of the GDPR and to data outside the scope of these Articles whose disclosure would cause immediate harm to the data subject (e.g., location data, data concerning private communications, national identification numbers, or financial data such as transaction summaries or credit card numbers). credit”). In this case, the documents being transported, addressed to a bank and which, in this specific instance, have been lost, include both the ID number and a complete copy thereof. Furthermore, the lost envelope contains the bank account number, among other data. The processing of this data poses a risk to the privacy of the affected party, because if a third party gains access to the data contained in the ID card and the image of the document itself, along with the bank documentation, it could lead to its use for committing fraud by impersonating the interested party. The following factors are also considered as aggravating circumstances: - The connection of the offender's activity with the processing of personal data (Article 76.2, letter b), of the LOPDGDD): ING, as a consequence of its business activity, routinely and continuously processes the personal data of a large number of data subjects, not only in relation to the sending (and subsequent receipt by ING) of documentation by clients or potential clients through transport companies under the terms established by the company itself. In short, the carrying out of financial activities, which is ING's main activity, necessarily involves C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 39/43 processing personal data of the natural persons who are clients (or potential clients) of said entity, not only with respect to the documentation sent by them through the channels established by the data controller, but for all types of activities. Thus, the infringement occurs within the framework of personal data processing that the data controller routinely carries out in its business and that is closely linked to it. For the purposes of deciding on the imposition of an administrative fine and its amount, in accordance with the evidence available at this procedural stage, it is considered that the balance of the circumstances contemplated in Article 83.2 of the GDPR and Article 76.2 of the LOPDGDD, with respect to the infringement committed by violating the provisions of Article 32 of the GDPR, allows for proposing an administrative fine of €500,000.00. VIII Corrective Measures Once the infringement has been confirmed, the resolution issued may establish the corrective measures that the infringing entity must adopt to end the non-compliance with personal data protection legislation, in this case, with Article 32 of the GDPR, in accordance with the provisions of Article 58.2(d) of the GDPR, which states that each supervisory authority may “require the controller or processor to bring processing operations into compliance with the provisions of this Regulation, where appropriate, in a specific manner and within a specified time frame…” Thus, the responsible entity may be required to adapt its actions to the personal data protection regulations, to the extent expressed in the preceding Legal Basis. However, in the present case, it is emphasized that the infringement occurred within the framework of a service agreement between ING and DYNAMIC that ended on February 28, 2023, and therefore, it is considered that the imposition of measures is not warranted. In light of the foregoing, the following PROPOSED RESOLUTION is issued: - That the President of the Spanish Data Protection Agency sanction ING BANK N.V., SPANISH BRANCH, with Tax Identification Number W0037986G, for an infringement of Article 32 of the GDPR, classified under Article 83.4 of the GDPR, with a fine of 500,000 euros (five hundred thousand euros). Furthermore, in accordance with the provisions of Article 85.2 of the LPACAP (Law on Administrative Procedure and Common Administrative Procedure), you are hereby informed that you may, at any time prior to the resolution of these proceedings, make voluntary payment of the proposed penalty, which will entail a 20% reduction of the penalty amount. With the application of this reduction, the penalty will be set at €400,000, and its payment will result in the termination of the proceedings, without prejudice to the imposition of the corresponding measures. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 40/43 The effectiveness of this reduction will be conditional upon the withdrawal or waiver of any administrative action or appeal against the penalty. ... For these purposes, if you choose to take advantage of this reduction, you must send the General Sub-Directorate for Data Inspection an express notification of your withdrawal or waiver of any administrative action or appeal against the penalty. If you choose to make voluntary payment of the amount specified above, in accordance with the provisions of Article 85.2, you must make the payment by depositing it into the restricted account IBAN: ES00-0000-0000-0000-0000-0000-0000-0000 (BIC/SWIFT Code: CAIXESBBXXX) held in the name of the Spanish Data Protection Agency at CAIXABANK, S.A., indicating in the payment details the reference number of the procedure shown in the heading of this document and the reason for the reduction of the penalty amount: voluntary payment. Likewise, you must send proof of payment to the General Sub-Directorate of Inspection in order to close the file. Therefore, you are hereby notified of the foregoing, and the procedure is made available to you so that, within TEN DAYS, you may submit any arguments you deem relevant in your defense and present any documents and information you consider pertinent, in accordance with Article 89.2 of the LPACAP (Law on the Common Administrative Procedure of Public Administrations). 926-050325 R.R.R. INSTRUCTOR ANNEX (…) >> SECOND: On August 22, 2025, ING paid the penalty in the amount of €400,000.00, taking advantage of the reduction provided for in the proposed resolution transcribed above. LEGAL BASIS I C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 41/43 Jurisdiction In accordance with the powers conferred upon each supervisory authority by Article 58.2 of Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter GDPR), and as established in Articles 47, 48.1, 64.2 and 68.1 of Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (hereinafter LOPDGDD), the Presidency of the Spanish Data Protection Agency is competent to resolve this procedure. Data Protection Likewise, Article 63.2 of the LOPDGDD (Organic Law on the Protection of Personal Data and Guarantee of Digital Rights) stipulates that: "The procedures processed by the Spanish Data Protection Agency shall be governed by the provisions of Regulation (EU) 2016/679, by this Organic Law, by the implementing regulations issued thereunder, and, insofar as they do not contradict them, subsidiarily, by the general rules on administrative procedures." II Termination of the Procedure Article 85 of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations (hereinafter LPACAP), under the heading “Termination of Sanctioning Procedures,” provides the following: “1. Once a sanctioning procedure has been initiated, if the offender acknowledges their responsibility, the procedure may be resolved by imposing the corresponding sanction. 2. When the sanction is solely monetary, or when a monetary sanction and a non-monetary sanction are applicable but the inappropriateness of the latter has been justified, voluntary payment by the alleged offender, at any time prior to the resolution, will imply the termination of the procedure, except with regard to restoring the altered situation or determining compensation for the damages caused by the commission of the infraction. 3. In both In cases where the sanction is solely monetary, the competent body for resolving the procedure will apply reductions of at least 20% to the proposed sanction amount, and these reductions are cumulative. These reductions must be specified in the notification initiating the procedure, and their effectiveness will be conditional upon the withdrawal or waiver of any administrative action or appeal against the sanction. The percentage reduction provided for in this section may be increased by regulation. III Voluntary Payment In accordance with the provisions of Article 85 of the LPACAP, the notified resolution allowed for voluntary payment of the proposed sanction, which would entail a 20% reduction. With the application of this reduction, the penalty would be set at €400,000.00 and C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 42/43 payment would imply the termination of the proceedings, without prejudice to the imposition of the corresponding measures. Following the aforementioned proposed resolution, and before a decision was issued by this authority, ING, on August 22, 2025, proceeded to make the voluntary payment, taking advantage of the 20% reduction. In accordance with section 3 of Article 85 of the LPACAP (Law on Administrative Procedure), the effectiveness of the aforementioned reduction will be conditional upon the withdrawal or waiver of any action or appeal through administrative channels against the penalty. It should be noted that, in accordance with the provisions of the LPACAP (Law on Administrative Procedure of Public Administrations), as well as the jurisprudence of the Supreme Court on this matter, the exercise of voluntary payment by the alleged offender does not exempt the administration from the obligation to resolve and notify all proceedings, regardless of how they were initiated. Similarly, Article 88 of the aforementioned law establishes that the resolution concluding the proceedings will decide all issues raised by the interested parties and any other issues arising therefrom. Therefore, in accordance with the applicable legislation and having assessed the criteria for determining the severity of the sanctions, the President of the Spanish Data Protection Agency resolves: FIRST: To declare the commission of the infringements and to confirm the sanctions determined in the operative part of the proposed resolution transcribed in this resolution. The sum of the aforementioned amounts totals €500,000.00. Following the voluntary payment made by ING BANK N.V., SPANISH BRANCH, although without acknowledgment of liability, pursuant to Article 85 of the LPACAP (Law on Administrative Procedure of Public Administrations), a 20% reduction of the aforementioned total is applied, resulting in a final amount of €400,000.00. The effectiveness of this reduction is conditional upon the withdrawal or waiver of any administrative action or appeal. SECOND: DECLARE the termination of procedure EXP202500113, in accordance with the provisions of Article 85 of the LPACAP. THIRD: NOTIFY ING BANK N.V., SPANISH BRANCH, of this resolution. FOURTH: In accordance with the provisions of Article 85 of the LPACAP, which conditions the reduction for voluntary payment on the withdrawal or waiver of any action or appeal through administrative channels, this resolution will be final through administrative channels and fully enforceable upon notification. In accordance with the provisions of Article 50 of the LOPDGDD, this resolution will be made public. Publication will take place once the resolution has been notified to the interested parties. C/ Jorge Juan, 6 www.aepd.es 28001 – Madrid sedeaepd.gob.es 43/43 Against this resolution, which concludes the administrative process as stipulated by Article 85 of the LPACAP, an appeal may be filed. Pursuant to Article 114.1.c) of Law 39/2015, of October 1, on the Common Administrative Procedure of Public Administrations, interested parties may file an appeal with the Administrative Chamber of the National Court, in accordance with the provisions of Article 25 and paragraph 5 of the fourth additional provision of Law 29/1998, of July 13, regulating the Administrative Jurisdiction, within two months from the day following notification of this act, as provided for in Article 46.1 of the aforementioned Law. However, in accordance with the provisions of Article 90.3 a) of the LPACAP, the final administrative decision may be provisionally suspended if the interested party expresses their intention to file an appeal. If this is the case, the interested party must formally notify the Spanish Data Protection Agency in writing, submitting it through the Agency's Electronic Registry [https://sedeaepd.gob.es/sede-electronica-web/], or through any of the other registries provided for in Article 16.4 of Law 39/2015, of October 1. They must also provide the Agency with documentation proving the effective filing of the administrative appeal. If the Agency does not receive notification of the filing of the administrative appeal within two months from the day following notification of this resolution, the precautionary suspension will be terminated. ... 968-101025 Lorenzo Cotino Hueso President of the Spanish Data Protection Agency 6 Jorge Juan Street www.aepd.es 28001 – Madrid sedeaepd.gob.es
