Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR

KINDRED GROUP LIMITED of Valletta, (Malta), hereinafter referred to individually as: Kindred, attorney: R.E. van Schaik, Esq.,

RISEPOINT LIMITED, located in Birkirkara (Malta), hereinafter referred to individually as: Risepoint, attorney: J.G. Reus, Esq., defendants. 1 Summary of the Case In these proceedings, the plaintiffs seek an order from the court requiring Risepoint, pursuant to Article 15 of the GDPR1, to grant access to certain (personal) data of the plaintiffs that has been processed in connection with the plaintiffs’ participation in online games of chance operated by Risepoint. An organization that does not meet the requirements of Article 80(1) of the GDPR is acting in these proceedings on behalf of and at the behest of the plaintiffs. The plaintiffs’ claims cannot therefore be granted. 2 The Proceedings

applies Art. 80(1), Art. 15

These proceedings were initiated by a petition.² In short, this petition contained a request to order the defendants to provide certain (personal) data to the plaintiffs, pursuant to the GDPR and the UAVG³ and, alternatively, pursuant to Articles 195 and 195a in conjunction with Article 194 of the Code of Civil Procedure (Rv). The plaintiffs subsequently notified the court that they would no longer base their requests on this alternative legal basis. By order of December 24, 2025, the court—as requested by the plaintiffs—pursuant to Article 69 of the Rv (the so-called “track switch”), ordered that the proceedings be continued in their current state in accordance with the rules governing summons proceedings. In short, the reason for this was that this case falls outside the territorial scope of the UAVG, so it does not follow from the law that these proceedings must be initiated by a petition. The court gave the parties the opportunity to adapt their arguments, if necessary, to the procedural rules applicable to summons proceedings. These proceedings are therefore summons proceedings.

applies Rv Art. 194, Rv Art. 69

The case file contains the following documents: - the plaintiffs’ petition, received by the court on July 25, 2025, with exhibits 1 through 12; - the amendment to the complaint, received by the court on August 6, 2025; - Kindred’s answer dated December 11, 2025, with Exhibits 1 through 19; - the letter from the plaintiffs’ attorney to the court dated December 12, 2025; - Risepoint’s answer dated December 18, 2025, with Exhibit 1; - the order dated December 24, 2025, which, in short, ordered the change of procedure pursuant to Article 69 of the Code of Civil Procedure; - the plaintiffs’ pleading in connection with the “change of course” to summons proceedings pursuant to Article 69 of the Code of Civil Procedure on the docket of January 28, 2026, with the same Exhibits 1 through 12 as in the initial complaint; - Kindred’s answer on the docket for March 11, 2026; - Risepoint’s pleading following the change of procedure on the docket for March 18, 2026, with exhibits RP1 through RP5; - the interim judgment of April 1, 2026, ordering an oral hearing; - the court’s notice to the parties’ attorneys dated June 15, 2026; - the plaintiffs’ exhibit submission, with exhibits 13 and 14; - Risepoint’s submission of a supplementary exhibit, with exhibit RP6; - the notice on behalf of Kindred stating that it will not be present at the oral hearing.

applies Art. 69

At the oral hearing on July 2, 2026, Messrs. [Name 1] and [Name 2]—both affiliated with Dynamiet Nederland B.V. (hereinafter: Dynamiet Nederland) – assisted by Mr. Van Duijn and attorney D. Berkhout. Appearing on behalf of Risepoint were Mr. Reus and attorney M. Moeskops. The attorneys for both sides submitted and presented their pleadings. The court clerk took notes on the further discussions that took place during the oral hearing. A date for the judgment was set during the oral hearing. The date for the judgment was subsequently set for today.

The Facts

Under the Dutch Gaming Act (Wok), it is prohibited to provide an opportunity to participate in games of chance unless a license has been granted for that purpose by the Gaming Authority pursuant to the Wok. Until October 1, 2021, it was not possible to obtain a license under the Wok to offer online games of chance in the Netherlands.

In the period prior to October 1, 2021, the plaintiffs participated in online games of chance via the websites www.unibet.com and www.unibet.eu (hereinafter: the Websites). The Websites were operated by Risepoint (then known as Trannel International Ltd). Risepoint/Trannel used the Unibet trademark and logo and also used the name “Unibet” to refer to itself.

Lawsuits have been filed in various courts in the Netherlands by gambling participants who took part in online games of chance in the Netherlands prior to October 1, 2021, against the relevant gambling providers.

Until October 31, 2024, Kindred was an (indirect) shareholder in and the parent company of Risepoint. On October 31, 2024, the shares in Risepoint were transferred to a third party.

Dynamiet Nederland B.V. (hereinafter: Dynamiet Nederland) operates a business that, among other things, provides legal services to consumers who have participated in online games of chance offered in the Netherlands without a Dutch license.

A group of consumers who participated in online games of chance on the websites from the Netherlands and lost money in the process—including the plaintiffs—has assigned (or transferred) any claims for reimbursement or damages against Kindred and Risepoint regarding these gambling losses to Dynamiet, or at least have instructed Dynamiet to pursue those claims in its own name.

The plaintiffs have signed an “Authorization Form” containing the following or similar text: “With this form, I authorize [Dynamiet Nederland] to act on my behalf as my legal service provider in all matters related to funds unjustly paid by me to online casinos. [Dynamiet Nederland] is authorized to represent me in legal and extrajudicial proceedings, and to act on my behalf in court hearings, including speaking on my behalf during such hearings. This authorization grants permission for, but is not limited to, the following actions: - Initiating and conducting legal proceedings, including speaking on my behalf during court hearings; - Drafting and signing legal documents, such as summonses and pleadings; - Obtaining judgments and enforceable titles - Representing me in class-action lawsuits (...) (...)  Submitting access requests under Article 15 of the GDPR regarding my account and transaction data with online gambling providers.’

applies Art. 15

The plaintiffs (through their authorized representative, Dynamiet Nederland) submitted requests for access based on the GDPR to Risepoint during the period from December 2024 through January 2025. In doing so, Dynamiet Nederland sent a letter to Risepoint containing the following or similar text: “The client is requesting access to their personal data in accordance with Article 15 of the General Data Protection Regulation (GDPR). Please confirm whether or not you are processing personal data concerning my client, as defined by Article 4(1) and (2) of the GDPR. If you are processing my client’s personal data, I kindly request access to the following information as stipulated by Article 15 of the GDPR: 1 All personal data concerning my client that you have processed; 2 The contract you entered into with my client that enabled him to place bets via your online system, as well as the terms and conditions my client accepted when creating the player account; 3 Comprehensive information about all financial transactions or changes, including deposits my client has made, withdrawals, and any bank transfers or other payment methods used; 4 A detailed list of all online games my client has participated in on your website and any other websites operated by you, specifically: - The type of bet placed (e.g., event or result bet); - The date and amount of each bet; - A complete list of wins and losses, broken down by event and result bets; 5 A description of the actions and measures taken by your organization to ensure that consumers receive the support they need to avoid addiction and other health issues caused by (excessive) betting. Please provide the foregoing in a structured, commonly used, and machine-readable format, as outlined in Article 20(1) of the GDPR. This request explicitly includes any other services or companies for which you are the data controller, as defined by Article 4(7) of the GDPR. In accordance with Article 12(3) of the GDPR, you are required to provide the requested information as soon as possible, no later than one month after receiving this request. Should you fail to comply with this request within the specified time, we reserve the right to take legal action (…).’

applies Art. 4(1), Art. 4(2), Art. 4(7), Art. 12(3), Art. 20(1), Art. 15

None of the plaintiffs received the requested data from Risepoint.

On October 10, 2025, Dynamiet Nederland initiated civil proceedings on the merits against Kindred and Risepoint regarding gambling losses incurred by a group of consumers who participated in online games of chance on the Websites prior to October 1, 2021. The plaintiffs belong to this group of consumers.

The Dispute

The plaintiffs are (now) seeking—in summary—that the court issue a judgment, to be provisionally enforceable to the extent possible: (I.) Order Risepoint to provide the plaintiffs with the following information within one month: - a) all personal data of the plaintiffs that Unibet (the court understands this to mean: Risepoint) has processed, including, at a minimum, a list of all (real) names, usernames, email addresses, bank account numbers, and other available information regarding the plaintiffs’ identities; - b) the agreements entered into between Unibet (the court understands this to mean: Risepoint) and the plaintiffs, which enabled the plaintiffs to place bets via Unibet’s (the court understands this to mean: Risepoint), as well as any terms and conditions the plaintiffs accepted when creating their player accounts; - c) a summary of all information regarding the plaintiffs’ payments to Unibet (the court understands this to mean: Risepoint), including details such as the date, time, and amounts of deposits and the payment methods used, as well as the bank accounts from which the payments were made; - d) a summary of all information regarding the plaintiffs’ online gambling activity, including, in particular, the dates, times, and amounts of (i) wagers, (ii) amounts won, (iii) amounts paid out, and (iv) losses, broken down by the type of bet placed (e.g., event or result bets); and - e) a list of the parties to whom the data referred to in (i) through (iv) above was provided, along with an explanation of the conditions under which this occurred; and to provide this data (i) in digital form, (ii) in commonly used file formats, (iii) accompanied by metadata that enables plaintiffs to retrieve specific information, and (iv) in such a way that the data is fully searchable when uploaded to a commonly used document management system. (II.) Order Risepoint to pay a penalty of €100,000 for each separate violation of the orders requested under I. requested orders, and €100,000 for each day or part thereof that Risepoint fails to comply, in whole or in part, with those orders; with Risepoint ordered to pay the costs of the proceedings and with the issuance of a certificate as referred to in Article 53 of the Brussels I bis Regulation.⁴

applies Art. 53

Risepoint contests the claim and argues that the plaintiffs’ claim is inadmissible or, at the very least, that those claims should be dismissed. Both Risepoint and Kindred seek an order requiring the plaintiffs to pay the litigation costs, which are to be declared provisionally enforceable.

The parties’ positions are discussed in more detail below, to the extent necessary.

The Assessment Jurisdiction and Applicable Law

This case has an international character because Kindred and Risepoint are incorporated in Malta. This means that the court must assess ex officio whether it has jurisdiction and—if so—under which substantive law the plaintiffs’ claims must be assessed.

The plaintiffs’ claims—which are now directed exclusively against Risepoint—are based on the GDPR. It is not in dispute that, in this context, the plaintiffs can be regarded as “data subjects” and Risepoint as a “data controller,” in each case within the meaning of the GDPR. For this reason, and because the plaintiffs habitually reside in the Netherlands, the court has jurisdiction to hear the claims against Risepoint pursuant to Article 79(2), second sentence, of the GDPR.

applies Art. 79(2)

It is not in dispute between the parties that the claims must be assessed on the basis of the GDPR, which is directly applicable under both Maltese and Dutch law.

Risepoint cites two provisions on the basis of which the court should not proceed to assess the claims: the Maltese “Subsidiary Legislation 586.09 Restriction of the Data Protection (Obligations and Rights) Regulations” (hereinafter: Subsidiary Legislation 586.09) and Article 80(1) of the GDPR. Subsidiary Legislation 586.09 Does Not Preclude an Assessment

applies Art. 80(1)

The parties disagree on whether Risepoint can rely on Subsidiary Legislation 586.09, which in turn is based on the Malta Data Protection Act 2018. The court will address this point of dispute below.

The court finds that the claim is not automatically barred by the Maltese exception invoked by Risepoint. This finding is based on the following considerations.

Pursuant to Article 23(1)(i) of the GDPR, the scope of the obligations and rights referred to in a number of the articles of the GDPR may, under certain circumstances and conditions, be limited by national legislation. Subsidiary Legislation 586.09 was enacted in that context and contains, among other things, the following provisions: “[Article 4.] Any restriction on the rights of the data subject referred to in Article 23 of the Regulation shall only apply where such restrictions are a necessary measure required: (e) for the establishment, exercise, or defense of a legal claim and for legal proceedings that may be instituted under any law; (...) [Article 7.] Any restriction applied under these regulations shall respect the essence of the fundamental rights and freedoms of the data subject and shall be a necessary and proportionate measure.

applies Art. 23(1)(i), Art. 4, Art. 7, Art. 23

It follows from the cited provisions that, under the GDPR as well as under Maltese law, the right of access may be restricted only if the restriction is a necessary and proportionate measure. Subsidiary Legislation 586.09 does not automatically mean that the data controller may refuse data subjects access if that information could be used against him in ongoing or impending proceedings. Even if Subsidiary Legislation 586.09 applies, the court must therefore assess the merits of the refusal of a request for access. The Maltese supervisory authority also interprets the provision in this way.5

The controller may also deny a data subject access if the request is excessive, for example, because the data subject repeatedly submits requests or submits requests for no other purpose than to fabricate a violation of the GDPR.6 In such cases, it is up to the controller to clearly demonstrate that the data subject submitted a request for access under Article 15 of the GDPR not to obtain information about that processing, but to artificially create the conditions for obtaining compensation from that data controller.7 These situations do not arise in this case; in any event, Risepoint has not demonstrated them. Article 80(1) of the GDPR does, however, preclude such an assessment

applies Art. 80(1), Art. 15

Risepoint also invokes Article 80(1) of the GDPR; it contends that the court cannot proceed to assess the claim because the requirements of this article have not been met. The plaintiffs have pointed out that the proceedings are being conducted in their names.

applies Art. 80(1)

The court finds that the plaintiffs have instructed a professional party to conduct these proceedings on their behalf, while this professional party does not meet the requirements of Article 80(1) of the AVG. The court will therefore declare the plaintiffs’ claims inadmissible due to a violation of Articles 80(1) and 79 of the GDPR. The court will explain this ruling below.

applies Art. 80(1), Art. 79

These proceedings concern the plaintiffs’ rights under (among other things) Article 15 of the GDPR. It is undisputed that Risepoint received out-of-court requests under Article 15 of the GDPR regarding the plaintiffs’ personal data and that it did not comply with these requests. Through these proceedings, the plaintiffs seek to have the court order Risepoint to grant them access pursuant to (Article 15 of) the GDPR.

applies Art. 15

It essentially follows from Article 80(1) in conjunction with Article 79(1) of the GDPR that a data subject has the right to instruct a professional party to bring an effective legal action on his or her behalf for a violation of a GDPR right, provided that such a professional party meets certain conditions (set forth in Article 80(1) of the GDPR). Dynamiet Nederland does not meet these conditions, in part because it is a for-profit entity.

applies Art. 79(1), Art. 80(1)

The “data subjects” within the meaning of the GDPR in these proceedings are officially the 51 plaintiffs listed in the heading of this judgment. However, this does not alter the fact that Dynamiet Nederland is acting in these proceedings on behalf of and at the request of these plaintiffs. In this regard, the court first notes the scope of the authorization that the plaintiffs have granted to Dynamiet Nederland (see paragraph 3.7 of this judgment). Furthermore, only two individuals affiliated with Dynamiet Nederland appeared on behalf of the plaintiffs at the oral hearing. None of the plaintiffs themselves were present at the oral hearing. Dynamiet Nederland’s attorney also stated at the oral hearing that Dynamiet Nederland is acting on behalf of the plaintiffs in these proceedings.

In the court’s opinion, the foregoing allows for no other conclusion than that the plaintiffs instructed Dynamiet Nederland to conduct these proceedings on their behalf, even though it does not meet the requirements of Article 80(1) of the GDPR. This is in violation of Article 80(1) in conjunction with Article 79 of the GDPR. The plaintiffs therefore cannot successfully base their claims in these proceedings on the GDPR.

applies Art. 80(1), Art. 79

The plaintiffs have alternatively based their claims on several human rights. However, in the court’s opinion, a reliance on fundamental rights cannot be used to circumvent (the purpose and scope of) Article 80(1) of the AVG. The plaintiffs’ reliance on other fundamental rights therefore does not serve their purpose. Litigation Costs

applies Art. 80(1)

As the party found to have lost the case against Risepoint, the plaintiffs will be ordered to pay Risepoint’s litigation costs. Risepoint’s litigation costs are estimated at: - court filing fee: €714 - attorney’s fees: €1,959 (3 points × Rate II at €653) - incidental costs: €189 (including any increase specified in the decision) total: €2,862.

In their initial pleading, the plaintiffs also requested that the court order Kindred to disclose the information. Kindred raised a defense against this. The plaintiffs’ amendment to the complaint states that the claims are now directed exclusively against Risepoint. In view of this, the plaintiffs are also the unsuccessful party with respect to Kindred. The plaintiffs will therefore also be ordered to reimburse Kindred’s litigation costs. Kindred’s litigation costs are estimated at: - court filing fee: €714 - attorney’s fees: €653 (1 point × Rate II at €653) - incidental costs: €189 (including any increase specified in the decision) total: €1,556.

The interest claimed by Risepoint on the litigation costs will be awarded as set forth in the decision.

These orders for litigation costs will be declared provisionally enforceable, as requested by Risepoint and Kindred.

The Decision The Court 6.1. declares the plaintiffs’ claims inadmissible; 6.2. orders the plaintiffs to pay Risepoint’s litigation costs of €2,862 within 14 days of receiving a demand to that effect. If the plaintiffs fail to comply with this order in a timely manner and the judgment is subsequently served, the plaintiffs must pay an additional €98 in subsequent costs, plus the costs of service; 6.3. orders the plaintiffs to pay Kindred’s litigation costs of €1,556 within 14 days of receiving a written demand to that effect. If the plaintiffs fail to comply with this order in a timely manner and the judgment is subsequently served, the plaintiffs must pay an additional €98 in subsequent costs, plus the costs of service; 6.4. orders the plaintiffs to pay statutory interest as provided for in Article 6:119 of the Dutch Civil Code on the litigation costs referred to in 6.2 if these are not paid within fourteen days of being notified to do so; 6.5. declares the orders set forth in 6.2 through 6.4 to be provisionally enforceable. This judgment was rendered by C.J-A. Seinen, Esq., and pronounced in open court on September 2, 2026. 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJEU 2016, L 119/1. 2 The case was therefore originally registered under case number C/09/689238 / HA RK 25-386. 3 General Data Protection Regulation Implementation Act. 4 Regulation (EU) No. 1215/2012 of the European Parliament and of the Council of December 12, 2012, on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters (recast), OJEU 2012, L 351/1. 5 Information and Data Protection Commissioner of Malta, CDP/COMP/557/2024, para. 23. 6 Art. 12(5) of the GDPR; CJEU, March 19, 2026, C-526/24 (Rottler Eyewear), paras. 34–37.

applies Art. 12(5)

Court of Justice of the European Union, March 19, 2026, C-526/24 (Rottler Eyewear), para. 41.