[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f7nuWqVgegflLvZADGFjTdHnnTw_kS4TP1aahklP7ZRU":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":47},"a93a4d07-75b5-475e-9238-f720d714c9e6","dutch-court-forces-gambling-firms-to-honor-gdpr-data-access-rights","4fb6420b-3c51-47ef-b869-33e268267279","Dutch Court Forces Gambling Firms to Honor GDPR Data Access Rights","Kindred Group PLC and Risepoint Limited were ruled to be GDPR data controllers by a Dutch court after attempting to deny users access to their own transaction and game participation data. The companies' claims that they were not controllers and that requests were abusive were rejected, highlighting the legal risk of mischaracterizing data responsibilities. This case underscores that organizations cannot escape GDPR obligations by disputing controller status — courts will apply CJEU precedent to determine actual roles based on data processing activities. Failure to honor Subject Access Requests (SARs) in a timely and valid manner exposes organizations to litigation, reputational damage, and potential regulatory fines. Understanding your organization's true role as a controller or processor is a foundational GDPR compliance requirement.","**Immediate actions:**\n- Conduct a formal data mapping exercise to accurately classify your organization's role (controller vs. processor) for all personal data processing activities.\n- Establish a documented Subject Access Request (SAR) intake and response procedure with clear ownership and a tracked 30-day response deadline.\n\n**Long-term improvements:**\n- Implement a Privacy Information Management System (PIMS) to maintain up-to-date records of processing activities as required under GDPR Article 30.\n- Train legal, compliance, and customer service teams on GDPR data subject rights to prevent invalid rejection of legitimate access requests.\n- Engage external Data Protection counsel periodically to review controller\u002Fprocessor determinations against evolving CJEU case law.\n\n**Detection & governance measures:**\n- Deploy a SAR tracking system that flags overdue or disputed requests for escalation before litigation risk materializes.\n- Schedule annual GDPR compliance audits to identify gaps in data subject rights fulfillment across all group entities and subsidiaries.",[12,13,14,15,16,17,18,19,20],"GDPR Article 4(7) — Definition of Controller","GDPR Article 15 — Right of Access by the Data Subject","GDPR Article 30 — Records of Processing Activities","GDPR Article 12 — Transparent Information and Modalities","CJEU Case Law on Controller Determination","NIST Privacy Framework PR.DS-P1 — Data Processing Policies","ISO\u002FIEC 27701:2019 — Privacy Information Management","CIS Control 3 — Data Protection","ITIL Service Management — Request Fulfillment Process","published","2026-06-30T12:20:21.888936+00:00","2026-06-30T12:20:21.752+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Rb._Den_Haag_-_C\u002F09\u002F689833&diff=52019&oldid=52018","rb-den-haag-c-09-689833-d5c2f7","Rb. Den Haag - C\u002F09\u002F689833",[29,35,41],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":36,"name":37,"slug":38,"description":39,"color":40},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":42,"name":43,"slug":44,"description":45,"color":46},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[]]