Dutch banks have been told to stop using their customers' payments data for the purposes of personalised direct marketing.
Last month ING said that it planned to start using transaction data to send its customers more relevant email and text message offers.
The plan drew complaints from privacy advocates, prompting the Dutch Data Protection Authority to write to the Dutch Banking Authority making it clear that banks are "not allowed" to simply send their customers personalised offers based on payment details.
Says the authority's board member Katja Mur: "Payment data gives a complete picture of someone's life: what do you spend your money on, which associations do you belong to, who do you associate with, which patterns are visible? That is why the AP considers it important to point out the banking sector to the privacy rules."
While ING prompted the letter, the authority says other banks are carrying out similar activities. Newspaper de Volkskrant has identified ABN Amro, Rabobank and De Volksbank as potential culprits.
ABN Amro has since acknowledged its use of payments data and has stopped the practice temporarily ahead of a meeting with the data protection agency, adding: "We want to talk with the DPA in order to clarify how their request should be interpreted."
However, the bank insists that it only sends messages if it believes they are relevant to customers, offering the example of a reminder to clients with an interest-only mortgage that they can make additional payments on their mortgage when they have the financial means to do so.