[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f-876_p1gTUUmC2embKe7cJbzDJPti03N7HW7qq3WTbo":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47,"controls":48},"8dd39911-d824-4df0-abaf-dbe8974651c8","court-orders-gambling-operator-to-honour-gdpr-data-access-request-after-unlawful-refusal","7a956e9c-ab14-48d9-ae4d-102eff2c7304","Court Orders Gambling Operator to Honour GDPR Data Access Request After Unlawful Refusal","Risepoint Limited attempted to withhold personal gambling and transaction data from a data subject, incorrectly citing Maltese law as a justification and claiming the access request was excessive because it was intended for use in legal proceedings. The Court of Appeal Den Haag upheld the lower court's ruling, confirming that Article 15 GDPR access rights are broad and cannot be restricted simply because a requester intends to use the data to establish legal liability. This case underscores that controllers cannot unilaterally reinterpret the purpose of a Subject Access Request (SAR) to avoid compliance. Mishandling SARs exposes organisations to court orders, reputational damage, and potential regulatory fines, making robust SAR processes a legal and operational necessity.","**Immediate actions:**\n- Audit all open or recently closed Subject Access Requests to ensure responses were complete and legally compliant.\n- Train data protection and legal teams on CJEU precedent confirming that SARs can be made for purposes including establishing legal liability without constituting an abuse of rights.\n\n**Process & Policy improvements:**\n- Establish a documented SAR handling procedure that clearly defines what data must be disclosed, with legal review gates before any data is withheld.\n- Ensure internal policies do not permit withholding data on the basis of the requester's suspected motive unless there is a clear, defensible legal exemption under applicable GDPR provisions.\n- Appoint or empower a qualified Data Protection Officer (DPO) to make final decisions on contested SARs before deadlines expire.\n\n**Long-term governance improvements:**\n- Implement a data inventory and mapping programme so all personal data categories (including transaction logs) can be located and retrieved promptly in response to any SAR.\n- Conduct annual regulatory compliance reviews covering all jurisdictions in which the organisation operates to prevent conflation of local law with GDPR obligations.\n- Integrate SAR response metrics into board-level data governance reporting to ensure accountability and early escalation of disputes.",[12,13,14,15,16,17,18,19],"GDPR Article 15 (Right of access by the data subject)","GDPR Article 12 (Transparent information and communication)","GDPR Article 17 (Right to erasure – contextual awareness of related rights)","CJEU Case C-307\u002F22 (FT v DW – purpose of access requests)","NIST Privacy Framework PR.DS-P1 (Data subject rights management)","CIS Control 3 (Data Protection – data inventory and classification)","ISO\u002FIEC 27701:2019 Section 7.3.2 (Fulfilling data subject access requests)","ITIL Service Request Management (handling formal data subject requests as a defined service)",{},"published","2026-10-12T10:20:23.422693+00:00","2026-10-12T10:20:23.374+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=GHDHA_-_200.361.079\u002F01&diff=53369&oldid=0","ghdha-200-361-079-01-e999ed","GHDHA - 200.361.079\u002F01",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[]]