The DDPA carried out an investigation15 into a complaint received by a person who was the recipient of an unsolicited letter from a party that he was not in contact with. The DDPA found out that ASN Bank N.V. had been providing personal data of its clients to third parties. Pursuant to the Data Protection Act, ASN Bank is not allowed to provide the personal data of its clients to third parties without its clients' explicit consent.

The DDPA considers that it is insufficient to provide the current clients of ASN Bank with an opt-out option. ASN Bank must provide its current clients at no cost the option of a specific and informed consent for the provision of their data to a third party. Furthermore, ASN Bank must ensure that third parties that received these personal data destroy these data unless explicit consent has been provided by the client. For future clients the DDPA mentioned that, provided that future clients are informed clearly and in a particular manner about the provision of data to a third party, an option to opt out at no charge will be sufficient.