GHDHA - 200.361.079/01
Dutch court orders controller to provide gambling data access under GDPR.
Run Risepoint Limited?
Get an email when a reviewed story names Risepoint Limited, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
The Court of Appeal Den Haag upheld a lower court's decision, ordering Risepoint Limited to provide a data subject with full access to their personal gambling and transaction data under Article 15 of the GDPR. The controller had attempted to withhold transaction data, citing Maltese law and arguing the request was excessive and intended for legal proceedings. The court rejected these arguments, referencing CJEU precedent that access requests can be made for purposes beyond understanding processing, including establishing liability, and that such requests do not constitute an abuse of rights.
The lesson from this incident
Full lessonRisepoint Limited attempted to withhold personal gambling and transaction data from a data subject, incorrectly citing Maltese law as a justification and claiming the access request was excessive because it was intended for use in legal proceedings. The Court of Appeal Den Haag upheld the lower court's ruling, confirming that Article 15 GDPR access rights are broad and cannot be restricted simply because a requester intends to use the data to establish legal liability. This case underscores that controllers cannot unilaterally reinterpret the purpose of a Subject Access Request (SAR) to avoid compliance. Mishandling SARs exposes organisations to court orders, reputational damage, and potential regulatory fines, making robust SAR processes a legal and operational necessity.