[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fmvqXCe0CjuiGxQHSWAx_K0ZwsUCT5AafhTZu_zgjoN8":3},{"article":4,"iocs":41,"watch_terms":42,"solutions":43,"lesson":46},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"7a956e9c-ab14-48d9-ae4d-102eff2c7304","GHDHA - 200.361.079\u002F01","ghdha-200-361-079-01-e999ed","Created page with \"{{COURTdecisionBOX |Jurisdiction=Netherlands |Court-BG-Color= |Courtlogo=Courts_logo1.png |Court_Abbrevation=GHDHA |Court_Original_Name=Gerechtshof Den Haag |Court_English_Name=Court of Appeal Den Haag |Court_With_Country=GHDHA (Netherlands) |Case_Number_Name=200.361.079\u002F01 |ECLI=ECLI:NL:GHDHA:2026:2861 |Original_Source_Name_1=De Rechtspraak |Original_Source_Link_1=https:\u002F\u002Fuitspraken.rechtspraak.nl\u002Fdetails?id=ECLI:NL:GHDHA:2026:2861&showbutton=true&keyword=avg&idx=6...\" Show changes","The Court of Appeal Den Haag upheld a lower court's decision, ordering Risepoint Limited to provide a data subject with full access to their personal gambling and transaction data under Article 15 of the GDPR. The controller had attempted to withhold transaction data, citing Maltese law and arguing the request was excessive and intended for legal proceedings. The court rejected these arguments, referencing CJEU precedent that access requests can be made for purposes beyond understanding processing, including establishing liability, and that such requests do not constitute an abuse of rights.","Dutch court orders controller to provide gambling data access under GDPR.","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=GHDHA_-_200.361.079\u002F01&diff=53369&oldid=0","https:\u002F\u002Fgdprhub.eu\u002Fimages\u002F4\u002F4c\u002FCourts_logo1.png","2026-10-12T09:54:48+00:00","2026-10-12T10:00:18.166649+00:00",7,[17,20],{"name":18,"type":19},"Risepoint Limited","vendor",{"name":21,"type":22},"online gambling services","product","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":23,"icon":25,"name":26,"slug":27},null,"Policy","policy",[29,34,39],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","GDPR","gdpr",{"category":35},{"id":36,"icon":25,"name":37,"slug":38},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":40},{"id":23,"icon":25,"name":26,"slug":27},[],[18,21],{"controls":44,"vendors":45},[],[],{"slug":47,"title":48,"body":49,"framework_refs":50,"framework_notes":59},"court-orders-gambling-operator-to-honour-gdpr-data-access-request-after-unlawful-refusal","Court Orders Gambling Operator to Honour GDPR Data Access Request After Unlawful Refusal","Risepoint Limited attempted to withhold personal gambling and transaction data from a data subject, incorrectly citing Maltese law as a justification and claiming the access request was excessive because it was intended for use in legal proceedings. The Court of Appeal Den Haag upheld the lower court's ruling, confirming that Article 15 GDPR access rights are broad and cannot be restricted simply because a requester intends to use the data to establish legal liability. This case underscores that controllers cannot unilaterally reinterpret the purpose of a Subject Access Request (SAR) to avoid compliance. Mishandling SARs exposes organisations to court orders, reputational damage, and potential regulatory fines, making robust SAR processes a legal and operational necessity.",[51,52,53,54,55,56,57,58],"GDPR Article 15 (Right of access by the data subject)","GDPR Article 12 (Transparent information and communication)","GDPR Article 17 (Right to erasure – contextual awareness of related rights)","CJEU Case C-307\u002F22 (FT v DW – purpose of access requests)","NIST Privacy Framework PR.DS-P1 (Data subject rights management)","CIS Control 3 (Data Protection – data inventory and classification)","ISO\u002FIEC 27701:2019 Section 7.3.2 (Fulfilling data subject access requests)","ITIL Service Request Management (handling formal data subject requests as a defined service)",{}]