Dutch SA Sanctions Credit Card Company for Failure to Perform Data Protection Impact Assessment

In December 2023 the Dutch Supervisory Authority fined a credit card company €150,000 for failing to perform a GDPR-required Data Protection Impact Assessment for its identification and verification process, which involved large-scale processing (1.5 million customers) and sensitive personal data (names, DOB, place of birth, government ID numbers, photos, contact details). The SA determined the DPIA was required under EDPB guidance because the processing met multiple criteria for high-risk processing.