General Awareness on Data Protection

General Awareness

• ING is committed to supporting all employees, including those with disabilities.
• Digital accessibility is a goal for all ING employees and supported by colleagues.
• International Web Content Accessibility Guidelines (WCAG 2.1) were used.
• An accessible PDF is provided if the eLearning module does not meet screen reader requirements.
• Employees can confirm completion to [email protected] (optional cc to manager).
• Completing this training module is for general data protection overview.
• Tailored modules exist for employees in specific roles. (e.g., Process/Product owner, Contract owner, Asset owner, Data owner)

Protecting Personal Data

• ING's training emphasizes data protection principles.
• This training is a general overview of data protection.
• Personal data must be handled safely and compliantly.
• ING emphasizes retaining trust and protecting privacy.
• Sharing personal data without consent can have serious consequences (e.g., identity theft, discrimination, malicious activity).

Why Personal Data Matters

• Privacy is a human right.
• Customers, suppliers, business partners, and employees trust ING to handle their personal information responsibly.
• Personal data is a valuable asset that needs protection.
• Protecting customer privacy is the responsibility of all involved.

How ING Takes Responsibility

• ING is committed to handling personal data according to expectations.
• ING complies with EU General Data Protection Regulation (GDPR) and local data protection requirements.
• ING applies GDPR principles globally unless local laws provide more protection.
• ING has a Global Personal Data Protection Policy (GPDP) and corporate rules (BCR) for employee, client, supplier and business partner data.
• Global Data Protection Policies are also shared externally and approved by the Dutch Data Protection Authority.

Internal Policies and Standards

• ING has a Global Personal Data Protection Internal Policy (GPDP).
• ING uses a Global Personal Data Protection Process Control Standard (PCS).

People to Support You

• ING has personal data experts in every business unit.
• Data protection contact information is available on ING Today.
• The Data Protection Executive Office (DPE) is the first point of contact for data concerns.
• The DPE office manages compliance with the GPDP and BCR.

Data Protection Executive Office (DPE)

• The DPE office handles data breaches, processing register supervision and impact assessments.
• The DPE office supports the business unit data protection executive (BU DPE).

Business Unit Data Protection Executive (BU DPE)

• The BU DPE is responsible for compliance within the business unit.
• The Chief Operating Officer (COO) fulfills this role at a business unit level.

Business Unit Data Protection Officer (BU DPO)

• The BU DPO provides data processing advice.
• The BU DPO monitors compliance with the GPDP, BCR, and local requirements.
• The BU DPO assists with cross-border issues and compliance supervision.
• The BU DPO is part of the data protection compliance risk function.
• The BU DPO is the single point of contact for the Data Protection Authority

Personal Data Fundamentals

• Personal data is any information about or identifiable to an individual. -Examples of personal data include name, address, account number, date of birth, marital status, phone number .
• Sensitive personal data requires extra protection.
  • Examples: health information, religious or philosophical beliefs, political opinions, sexual orientation, ethnic origin etc.
• Sensitive personal data must be handled with care and only processed in exceptional circumstances.

Consequences for ING

• Negative publicity, loss of reputation, investigation, and potential fines are potential consequences.
• Personal data breaches require prompt reporting to relevant authorities.

Data Breaches

• Data breaches can result from criminal activity or human error.
• Reporting of breaches must follow established protocols.

Storage and Access

• Protect folders and systems where documents are stored.
• Update access rights promptly when changes occur.
• Ensure access is only granted to those who need it.

How to Respond to a Breach

• Immediately mitigate the breach (e.g., recall emails).
• Inform the DPE office.
• Follow up with any necessary actions.
• Report breaches promptly to the DPE office .

The Principles of Processing Personal Data - Overview

• Processing personal data includes collecting, recording, organizing, and adapting data.
• Data processing must be aligned with GDPR, local laws and ING's corporate rules.
• Be confident about the procedures for handling personal data.
• Examples of actions include collecting, recording, organizing, structuring, storing, adapting, consulting, disclosing, combining, deleting, and destroying data.

What's Processing?

• Processing includes actions to personal data.
• Examples include collecting, recording, and organizing customer data

Purpose and Purpose Limitation

• Processing personal data needs a clearly defined purpose.
• The purpose must be relevant to the specific business activity.

Lawful Basis

• A lawful basis for processing personal data needs to apply, for example, consent, contract, legal obligation, and legitimate interest.

Transparency

• Informing individuals about how their data is used is critical for transparency.

Minimization

• Only collect the minimum amount of data needed.
• Information should be accurate, complete, and up to date.

Storage Limitation

• Store personal data appropriately; access should be limited to those who need it.

Integrity and Confidentiality

• Employ security measures to protect personal data from loss, alteration, and disclosure.
• Higher risk to sensitive personal data needs more rigorous security measures.
• Business Impact Assessments (BIAs) are mandatory for data held in assets or processes

Record of Processing Activity (RoPA)

• ING maintains a record of all personal data processing activities and parties involved.

DPIA(Data Protection Impact Assessment):

• ING performs DPIA before any data processing activities.
• Helps identify potential high risks from personal data processing.

Individual Rights

• Individuals have rights to access, rectify, and delete their personal data.
• Organisations have responsibilities regarding individuals’ rights .

Right to Object to Personal Offers

• Customers can object to unsolicited marketing communications.
• 'Opt-out' options for marketing communications should be provided.

Automated Decision-Making

• Automated processes for processing personal data need safeguards and customer consent.

Protecting Personal Data

• There are clear procedures to manage personal data for customers, employees, and business partners.
• ING has a data protection team to provide support and expertise