You buy a flight – and up pops an offer in your inbox for travel insurance from your bank.

But marketing plans floated by the bank ING last month are likely to breach privacy law, according to the Dutch privacy watchdog AP.

The body announced on Wednesday that banks should not offer their customers products on the basis of their confidential spending patterns. It added that all banks ‘should therefore take a good look at their policies around direct marketing.’

ING’s plans appear to have sparked a spate of complaints and questions to the AP in recent weeks from consumers who are concerned that their personal spending will be monitored and used for advertisements. The body has now written to the NVB Dutch banking association to make it clear what ‘rules of play’ should govern their use of client spending data for other purposes.

Katja Mur, a board member of the AP said in a press release: ‘Payment details really give a complete picture of someone’s life: where you spend your money, the associations you belong to, who you get on with, visible patterns. This is why the AP thinks it’s important to remind the banking sector about privacy regulations.’

Although the AP does not mention ING by name, it adds that ‘a bank’ recently changed its privacy statements, saying it plans to use payment details for direct marketing offers. ‘The AP has seen evidence that more banks are using client payment details for direct marketing purposes,’ the organisation adds, ‘so has chosen to warn all banks via the NVB association.’

It its letter, it warns that certain transactions are considered particularly sensitive in terms of privacy law, such as payments to ‘hospitals, pharmacies, casinos, sex clubs….religious groups [and political parties]’ and that bank clients have an expectation of privacy.

ING released a statement to DutchNews.nl saying that it was aware of the letter from the AP. ‘ING understands that the AP closely monitors the use of customer data for marketing purposes,’ it said. ‘The bank is currently studying the statement and has entered into talks with the AP. ING does not currently send its customers personal offers for relevant ING goods and services based on transaction data, and will not start these practices for the time being.’