Dutch Court Forces Gambling Firms to Honor GDPR Data Access Rights
Kindred Group PLC and Risepoint Limited were ruled to be GDPR data controllers by a Dutch court after attempting to deny users access to their own transaction and game participation data. The companies' claims that they were not controllers and that requests were abusive were rejected, highlighting the legal risk of mischaracterizing data responsibilities. This case underscores that organizations cannot escape GDPR obligations by disputing controller status — courts will apply CJEU precedent to determine actual roles based on data processing activities. Failure to honor Subject Access Requests (SARs) in a timely and valid manner exposes organizations to litigation, reputational damage, and potential regulatory fines. Understanding your organization's true role as a controller or processor is a foundational GDPR compliance requirement.
Tactical Insight
Immediate actions
- Conduct a formal data mapping exercise to accurately classify your organization's role (controller vs. processor) for all personal data processing activities.
- Establish a documented Subject Access Request (SAR) intake and response procedure with clear ownership and a tracked 30-day response deadline.
Long-term improvements
- Implement a Privacy Information Management System (PIMS) to maintain up-to-date records of processing activities as required under GDPR Article 30.
- Train legal, compliance, and customer service teams on GDPR data subject rights to prevent invalid rejection of legitimate access requests.
- Engage external Data Protection counsel periodically to review controller/processor determinations against evolving CJEU case law.
Detection & governance measures
- Deploy a SAR tracking system that flags overdue or disputed requests for escalation before litigation risk materializes.
- Schedule annual GDPR compliance audits to identify gaps in data subject rights fulfillment across all group entities and subsidiaries.