Enforcement · Autoriteit Persoonsgegevens EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

Royal Dutch Tennis Association ('KNLTB'): Insufficient legal basis for data processing

€525,000 Fine
Royal Dutch Tennis Association ('KNLTB')
THE NETHERLANDS
Art. 5 GDPR Art. 6 GDPR
Legitimate Interest Personal Data Controllers Marketing Direct Marketing Consent Processing Agreement Processing
Mar 3, 2020 Source

How it connects

Related across sources

Guidance EDPB Annual Report 2021 EDPB Literature General Data Protection Regulation (GDPR) ambiguity, national diversity and data protection officer certification: Implementing Art. 39(1) GDPR in France, Italy, Luxembourg and Spain Journal of Data Protection Privacy Literature GDPR Implementation Series ∙ Hungary: Introduction to the GDPR Application and a Brief History of Data Protection European Data Protection Law Review Literature GDPR Implementation Series ∙ Spain: Preparations for a New Law on Data Protection to Implement the GDPR European Data Protection Law Review Literature GDPR Implementation Series ∙ United Kingdom: Heading Towards Brexit but with a Data Protection Bill Implementing GDPR European Data Protection Law Review Case Law Google Spain SL and Google Inc. v AEPD and Mario Costeja González CJEU

Full text

The Dutch Data Protection Authority has fined the Royal Dutch Tennis Association ('KNLTB') with EUR 525,000 for selling the personal data of more than 350,000 of its members to sponsors who had contacted some of the members by mail and telephone for direct marketing purposes. It was found that the KNLTB sold personal data such as name, gender and address to third parties without obtaining the consent of the data subjects. The data protection authority also rejected the existence of a legitimate interest for the sale of the data and therefore decided that there was no legal basis for the transfer of the personal data to the sponsors. ---UPDATE--- Following the CJEU's court ruling, the controller and the DPA agreed to settle the case and reduce the fine from EUR 525,000 to EUR 250,000. The controller also admitted their wrongdoing.

Industry: Individuals and Private Associations

Original document at the source autoriteitpersoonsgegevens.nl

Similar Content