LG Freiburg im Breisgau - 8 O 203/24

Summary

A German court ruled that two online gambling service providers must grant a user full access to their gaming and transaction data under GDPR. The user sought this information to verify the lawfulness of data processing and understand their gambling behavior and entitlements. The court found the request admissible and justified, ordering the providers to disclose data related to the customer relationship, including gaming history and transactions.

Full text

Help LG Freiburg im Breisgau - 8 O 203/24: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 08:18, 9 June 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators17 editsmTag: Visual edit← Older edit Latest revision as of 09:21, 10 June 2026 view source Av (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators17 editsTag: Visual edit Line 62: Line 62: }}}} A court held two online gambling service providers must grant the data subject access to their complete gaming and transaction data in accordance with Articles 15(1) and 15(3) GDPR.A court held that two online gambling service providers must grant a user access to their complete gaming and transaction data in accordance with [[Article 15 GDPR|Articles 15(1)]] and [[Article 15 GDPR|15(3) GDPR]]. == English Summary ==== English Summary == Latest revision as of 09:21, 10 June 2026 LG Freiburg im Breisgau - 8 O 203/24 Court: LG Freiburg im Breisgau (Germany) Jurisdiction: Germany Relevant Law: Article 15(1) GDPR Article 15(3) GDPR Decided: 29.05.2026 Published: 02.06.2026 Parties: National Case Number/Name: 8 O 203/24 European Case Law Identifier: ECLI:DE:LGFREIB:2026:0529.8O203.24.00 Appeal from: Appeal to: Unknown Original Language(s): German Original Source: Landesrecht BW (in German) Initial Contributor: av A court held that two online gambling service providers must grant a user access to their complete gaming and transaction data in accordance with Articles 15(1) and 15(3) GDPR. Contents 1 English Summary 1.1 Facts 1.2 Holding 2 Comment 3 Further Resources 4 English Machine Translation of the Decision English Summary Facts A German user (the data subject) brought court proceedings against two online gambling service providers (the controllers) established in Malta. They offered online casino games and sports betting services that were accessible to everyone in Germany. The data subject requested access to the data concerning him processed by the controllers in April 2024. He wanted to obtain certainty about the lawfulness of the processing of his data and determine the extent of his gambling behaviour as well as the claims to which he was entitled against the controllers. The data subject claimed in court that the controllers had not fulfilled his access request and should therefore be ordered to jointly and severally provide him access to his complete gaming and transaction data pursuant to Articles 15(1) and 15(3) GDPR. The controllers stated that they had already provided the data subject access to the information he had requested and stated that the action should be dismissed. Holding The court held in a partial judgment that the action was admissible and largely justified. In order to pay winnings to the data subject, the controllers inevitably had to verify his identity and thus process his personal data. The court ordered the controllers to provide the data subject information about the personal data processed in context of the customer relationship, particularly data concerning the data subject’s gaming history and all transactions on his gaming accounts. The access request was not manifestly unfounded or excessive within the meaning of Article 12(5) GDPR. The court also held the controllers had not previously provided the data subject access to the required information in accordance with Articles 15(1) and 15(3) GDPR. However, the controllers were legally independent and did not operate the online gambling websites jointly. Therefore, the obligation to fulfil the access request was to be limited to their individual websites. Comment Share your comments here! Further Resources Share blogs or news articles here! English Machine Translation of the Decision The decision below is a machine translation of the German original. Please refer to the German original for more details. Court: Freiburg Regional Court (Breisgau), 8th Civil Chamber Date of Decision: May 29, 2026 Case Number: 8 O 203/24 ECLI: ECLI:DE:LGFREIB:2026:0529.8O203.24.00 Document Type: Partial Judgment Source: The player has a right to information from the sports betting provider regarding his bets. Judgment 1. Defendant 1 is ordered to provide the plaintiff with information about the data processed within the framework of the customer relationship existing between the plaintiff and Defendant 1 on the websites https://www. ... .de/de and https://sports. ... .de/de, in particular regarding all game histories and transactions for all of the plaintiff's gaming accounts; Defendant 2 is ordered to provide the plaintiff with information regarding the customer relationship existing between the plaintiff and Defendant 2 on the website https://games. ... .de/de processed data, in particular regarding all game histories and transactions for all game accounts of the plaintiff. Both defendants are ordered to provide information regarding the aforementioned obligation to disclose information about the customer relationship, specifically in addition to the following: a) which personal data of the plaintiff the defendants process; b) for what purpose this data is processed; c) which categories of personal data are processed; d) about the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; e) about the planned duration for which the personal data will be stored and the criteria for determining this duration; f) about the existence of a right to rectification or erasure of personal data concerning them or to restriction of processing by the controller or a right to object to such processing; g) about the existence of a right to lodge a complaint with a supervisory authority; - Page 1 of 13 - h) where the personal data are not collected from the data subject, all available information about the source of the data; i) about the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject; j) about whether data are transferred to third countries and what appropriate safeguards are in place in connection with such transfers; k) about the complete payment and gaming history of all the plaintiff's gaming accounts, which must be provided as a copy in a structured, commonly used, and machine-readable format, in particular CSV or Excel format. 2. In all other respects, the action is dismissed at the disclosure stage. 3. The decision on costs is reserved for the final judgment. 4. The judgment is provisionally enforceable upon provision of security in the amount of €500. Statement of Facts 1 The plaintiff is asserting claims against the defendants, providers of online gambling services based in the Republic of Malta under the domains https://www. ... .de/de, https:// sports. ... .de/de and https://games. ... .de/de in connection with his participation in these services. In a multi-stage action, the parties are currently litigating, at the first stage, the plaintiff's requests for information. The plaintiff intends to use the requested information to quantify the claim for reimbursement of lost stakes in the online gambling services offered by the defendants at the third stage. 2 In the past, the defendants offered online gambling services accessible to everyone in Germany based on a Maltese license. The defendant has since obtained a license in Germany (Exhibit K 2). By letter from his attorney dated April 22, 2024 (p. 18, para. 32), the plaintiff requested that the defendants provide him with information within 30 days regarding the data concerning him that was being processed by the defendants. 3 The plaintiff alleges that the defendants had him register multiple times on their websites. The defendants allegedly enabled the plainti

Entities