Court Orders Gambling Operator to Honour GDPR Data Access Request After Unlawful Refusal
Risepoint Limited attempted to withhold personal gambling and transaction data from a data subject, incorrectly citing Maltese law as a justification and claiming the access request was excessive because it was intended for use in legal proceedings. The Court of Appeal Den Haag upheld the lower court's ruling, confirming that Article 15 GDPR access rights are broad and cannot be restricted simply because a requester intends to use the data to establish legal liability. This case underscores that controllers cannot unilaterally reinterpret the purpose of a Subject Access Request (SAR) to avoid compliance. Mishandling SARs exposes organisations to court orders, reputational damage, and potential regulatory fines, making robust SAR processes a legal and operational necessity.
Tactical Insight
Immediate actions
- Audit all open or recently closed Subject Access Requests to ensure responses were complete and legally compliant.
- Train data protection and legal teams on CJEU precedent confirming that SARs can be made for purposes including establishing legal liability without constituting an abuse of rights.
Process & Policy improvements
- Establish a documented SAR handling procedure that clearly defines what data must be disclosed, with legal review gates before any data is withheld.
- Ensure internal policies do not permit withholding data on the basis of the requester's suspected motive unless there is a clear, defensible legal exemption under applicable GDPR provisions.
- Appoint or empower a qualified Data Protection Officer (DPO) to make final decisions on contested SARs before deadlines expire.
Long-term governance improvements
- Implement a data inventory and mapping programme so all personal data categories (including transaction logs) can be located and retrieved promptly in response to any SAR.
- Conduct annual regulatory compliance reviews covering all jurisdictions in which the organisation operates to prevent conflation of local law with GDPR obligations.
- Integrate SAR response metrics into board-level data governance reporting to ensure accountability and early escalation of disputes.