Rb. Den Haag - C/09/689833

In these proceedings, the plaintiffs seek that the court order the defendants, pursuant to the GDPR1, to grant each of them access to transaction data relating to the Unibet online gambling games in which they participated. The defendants refuse the plaintiffs access to this data because they believe that the plaintiffs are abusing their right of access; in any case, the defendants believe that they are entitled to refuse access because the plaintiffs are seeking access for a purpose other than that for which the right of access is intended.

By order of 31 July 20253, the court rejected the plaintiffs' request insofar as it was based on Articles 195 and 194 Rv. The court, applying Article 69 of the Dutch Code of Civil Procedure (the so-called 'track change'), ordered that the proceedings be continued in their current state in accordance with the rules applicable to summons proceedings. The parties were given the opportunity to adapt their arguments to those procedural rules, and they did so. Subsequently, on March 19, 2026, the GDPR case was heard orally.

The case file consists of the following documents: - the petition pursuant to Article 15 paragraph 1 of the GDPR dated March 10, 2025, with exhibits 1-17, which is to be regarded as a summons; - the statement of defense of Kindred dated June 6, 2025, with exhibits 1-22, which is to be regarded as a statement of defense; - the statement of defense of Risepoint dated June 10, 2025, with exhibits 1-16, which is to be regarded as a statement of defense; - the plaintiffs' letter of 17 June 2025 with exhibits 18-25; - the letter from Kindred of 17 June 2025 with exhibits 23 and 24; - the pleadings presented by the lawyers during the oral hearing of 19 June 2025; - the court's decision of 31 July 2025; - the plaintiffs' post-track submission of 3 September 2025; - the post-track submission of Kindred of 1 October 2025; - the post-track submission of Risepoint of 1 October 2025 with exhibits 17-20; - the interlocutory judgment of 3 December 2025 scheduling an oral hearing; - the notice from the Registry of 13 March 2026 containing a hearing agenda; - the deed of Risepoint dated March 13, 2026, with further exhibits 26 and 27; - the pleadings presented by the lawyers during the oral hearing on March 19, 2026.

(who did not submit a new request for access in 2025) and Claimant 7 (who only sent a request for access to [email address 2] in January 2025). These requests from claimants concern access to personal data processed in the context of their participation in online gambling via the Unibet Websites. More specifically, claimants request an overview of the transaction data and the types of games in which they participated. None of the claimants has received the requested data. 4 The dispute

Claimants claim – in summary – that the court, by judgment, insofar as possible provisionally enforceable: I. Order Risepoint and Kindred jointly, or at least each individually, to provide the relevant claimants within fourteen days after the date of this judgment, with regard to the processing of personal data referred to in the body of the introductory pleading and/or the (other) data referred to in the body of this summons, by granting each of the claimants access to the personal data processed concerning them, by providing each of the claimants with a copy of the personal data that constitute a complete picture of all direct or indirect transactions between each of the claimants and the defendants, to be provided electronically in a common format such as XLS(X) or CSV or by means of an Application Programming Interface (hereinafter: API), whereby the information and/or data to be provided to the claimants is intelligible and enables each of them to verify the accuracy of the personal data and the lawfulness of the processing of such data; II. to order Risepoint and Kindred jointly and severally to pay a penalty of € 2,500.00 for each day that they fail to comply with the judgment as referred to under I, II and/or III; III. To order Risepoint and Kindred jointly and severally to pay the costs of these proceedings.

The plaintiffs' claims are based on the GDPR. As held in consideration 4.3 of the order of 31 July 2025, the Dutch court has jurisdiction to hear these claims pursuant to Article 79(2) of the GDPR.

It is not in dispute between the parties that the claims must be assessed on the basis of the GDPR, which has direct effect under both Maltese and Dutch law. However, the parties disagree on the question of whether Kindred and Risepoint can invoke (successfully) the Maltese ‘Subsidiary Legislation 586.09 Restriction of the Data Protection (Obligations and Rights) Regulations’, which restricts certain rights under the GDPR. The court assesses this point of dispute in paragraphs 4.15 et seq.5.4. In short, the plaintiffs claim access to and a copy of the transaction data concerning them, primarily on the basis of Article 15 GDPR (the right of access) and subsidiarily on the basis of Article 20 GDPR (the right to data portability). Article 15 GDPR

According to Article 15(1) GDPR, a data subject whose personal data have been processed has the right to obtain confirmation from the controller as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to those personal data. According to Article 15(3) GDPR, the controller must provide the data subject, at his or her request, with a copy of the personal data being processed. Personal data?

In this case, it is not disputed that Unibet processed personal data within the meaning of (Article 4(1) of) the GDPR in the period up to 1 October 2021 in the context of the plaintiffs' participation in online gambling via the Websites. Nor is it disputed that the transaction data claimed by the plaintiffs can also be classified as personal data. Pursuant to Article 15 of the GDPR, the plaintiffs can therefore, in principle, claim access to and a copy of the transaction data concerning them from the controller(s) within the meaning of Article 4(7) of the GDPR. Who is the controller?

In these proceedings, it is not disputed that Risepoint can be considered a controller within the meaning of Article 4(7) of the GDPR.

Kindred disputes that it can be classified as a controller. According to Kindred, it did not exercise any actual decisive influence on the purpose and the (essential) means of processing the personal data at issue in this case. Period between May and the end of October 2024

The court is of the opinion that Kindred is indeed the controller with regard to access requests made in the period between May and the end of October 2024, but not with regard to access requests made in the period after October 2024. This judgment is based on the following considerations.

The court states upfront that the determining factor in the question of whether Kindred was the (whether or not: joint) controller is the situation at the moment the access request was made. This is consistent with the structure of the GDPR, which works with functional rather than formal role concepts; This implies that the assessment of the role an entity plays must be based on an analysis of the factual circumstances of the case.4 The use of the present tense in Article 4(7) of the GDPR5 underscores that controllership must be assessed on the basis of the situation as it exists at the time the data subject makes the information request.

According to settled case law of the Court of Justice of the European Union (Court of Justice, abbreviated: CJEU), the functionally understood concept of ‘controller’ must be interpreted broadly.6 Joint controllership does not require that the various undertakings involved in the processing of personal data bear equivalent responsibility for it, nor that they both be involved in the processing at all stages.7

In this case, nine claimants submitted access requests to Unibet in the period from May to October 2024 via the email addresses [email address 1] and/or [email address 2]. All claimants submitted a request for access (again) in January or February 2025 via (one of) these email addresses. The question is whether Kindred, together with Risepoint, actually exercised decisive influence during those periods on the purpose and the essential means of processing the claimants' personal data.

Claimen have pointed out that Kindred is the head of the Unibet group and that GDPR requests sent to Unibet email addresses ([email address 1] or [email address 3]) were answered from no-reply@kindredgroup.com, stating that ‘we’ needed more time for the data request. Following that answer, access to personal data was also provided to some claimants8 from that mailbox, showing that Kindred had access to that personal data. Access to the requested transaction data was refused, but the reason Kindred gave for this was not that it could not obtain that data, but that it invoked a ground for exception.

The privacy statement for www.unibet.nl dated August 12, 2022, submitted by Kindred, confirms that a single central privacy policy was indeed maintained for the Unibet brand name. It follows from the privacy statement that the purposes of the processing of personal data within the group were in any case determined at least partially centrally (underlining in quote by the court): “7 When do we share your personal data? However, it may happen that we share your personal data with other companies in the Kindred Group, with third parties providing services to you on our behalf, and with other third parties complying with our legal obligations. Other examples of when we share your personal data are when we are part of a merger or during a sale of the company. Even when your personal data is shared, we ensure that it is only used for the purposes set out in this policy. With other companies within the Kindred Group We may share the personal data we collect with other companies in the Kindred Group for the following purposes:  to provide you with products and services and to inform you of important changes or developments in the functions and operation of these products and services;  to respond to your questions and complaints;  (…)  Updating, consolidating and improving the accuracy of our records  Performing transactional analyses;  (…)  Customer modeling, statistical and trend analysis, with the aim of developing and improving products and services. With third parties We may share personal data with third parties in the following cases:  (…)  With service providers to enable us to deliver our services, such as companies that assist us with technological services, data storage and combination (…)” Kindred has confirmed that there was a Data Protection Officer (DPO) for the entire group, whose primary task was to oversee compliance with the GDPR within the group. 5.9.7. Risepoint confirms that prior to its departure from the Kindred Group, a central privacy policy was maintained within the group, including via the OneTrust platform managed by Kindred. Trannel/Risepoint could not process the personal data in the period up to November 2024 without the intervention of Kindred.

It follows from the foregoing that, in the period between May and the end of October 2024, Kindred exercised actual (co-)decisive influence over the purpose and the essential means of the processing of the personal data at issue in this case, both through its central policy and through the OneTrust platform prescribed and managed by it and the Kindred Privacy Team.

If there are multiple controllers, data subjects may request access from any of them pursuant to Article 26(3) of the GDPR. Period after the end of October 2024

Claimants 5 and 9 did not send a request for access to [email address 1] in the period between May and the end of October 2024; they only did so at the end of December 2024 and mid-February 2025. By then, the personal data of players who had participated in online gambling of the Kindred Group before October 2021 had already been transferred to Risepoint. The court must therefore assess whether Kindred was still a (joint) controller at the end of December 2024 and in mid-February 2025.

In view of Kindred's substantiated challenge, the court is of the opinion that, with regard to the period after October 2024, the plaintiffs have not sufficiently concretely argued that Kindred can be regarded as a (joint) controller within the meaning of Article 4(7) of the GDPR and/or Article 26 of the GDPR.

In the situation up to November 2024, there was a central policy within the group to which Trannel/Risepoint was also subject, but in the period thereafter, Risepoint could independently determine the purpose and means of the processing. The mere fact that Risepoint entered into agreements for the processing of personal data with an entity within the Kindred Group after its withdrawal from the Kindred Group does not mean that Kindred still exercised decisive influence over the purpose and essential means of processing the plaintiffs' personal data. The plaintiffs have not specified what Kindred's decisive influence over the processing of their data consisted of after November 2024.

The data processing agreements submitted by Kindred as exhibits 6 and 7 provide no grounds for the notion that Kindred could still exercise decisive influence over the purpose and means of processing personal data for Risepoint. In those agreements, Risepoint is clearly designated as the controller determining the purpose and means of processing; the entity within the Kindred Group (Kserol) may not process personal data other than in accordance with applicable law and the data processing agreement concluded with Risepoint. Article 12 paragraph 5 GDPR / Abuse of rights

Kindred and Risepoint also take the position that, pursuant to Article 12 paragraph 5 GDPR, they are not required to comply with the access requests because the plaintiffs are abusing their right of access. According to them, the plaintiffs submitted the access requests for a purpose other than that for which Article 15 GDPR is intended, namely to obtain information to substantiate a potential claim against Kindred and Risepoint. In this context, Kindred and Risepoint refer to German case law regarding GDPR access requests from gambling providers, arising from cases brought with the sole intent to recover gambling losses.

Article 12 paragraph 5 of the GDPR lists two reasons why a controller may refuse to comply with a request for access. According to the CJEU, those grounds relate to cases of abuse of rights in which the requests of the data subject are ‘manifestly unfounded’ or ‘excessive’, particularly when those requests are of a repetitive nature.9 The Court of Justice has also ruled that a request for access cannot be rejected solely on the ground that it has a purpose other than to inform oneself of the processing of personal data and to verify its lawfulness, because data subjects are not required to justify a request for access to the data.10

Pursuant to Article 12(5) of the GDPR, it is up to the controller to demonstrate the alleged manifestly unfounded or excessive nature of a request.

The applicants' requests are not manifestly unfounded,11 but are provisionally eligible for approval (see paragraphs 5.6 and 5.9 above). The court will address the question of whether the requests of the other claimants are excessive below in its consideration of the defendants' reliance on Articles 15(4) and 23(1) of the GDPR. Reliance on Article 15(4) / Article 23(1)(1) of the GDPR?

Furthermore, Kindred and Risepoint take the position that they are not required to comply with the access requests because they are entitled to rely on the exception referred to in Article 15(4) of the GDPR, or on an exception included in the Maltese implementing law pursuant to Article 23(1)(1)(i) of the GDPR. Risepoint states that it has been confronted with more than 8,000 access requests that are not made in the interest of data protection. This has an enormous impact on its business operations and, according to Risepoint, infringes upon its freedom of entrepreneurship. Kindred also considers the requests to be disproportionate. The plaintiffs' lawyer has submitted requests on behalf of 20,000 data subjects; handling a request takes approximately 90 minutes, which amounts to 30,000 man-hours. According to Kindred, this constitutes an extreme infringement of its rights and freedoms, in which it points out once again that the access requests are not being used for their intended purpose, but only to initiate legal proceedings whose viability is uncertain given the preliminary questions pending before the Supreme Court. Moreover, Kindred considers the requests to be excessive, because the plaintiffs are using the right of access with the sole intention of causing it harm or nuisance.

The provisions on which the defendants rely read as follows: Article 15 paragraph 4 GDPR: The right to obtain a copy referred to in paragraph 3 shall not prejudice the rights and freedoms of others. Article 23(1)(i) GDPR: The scope of the obligations and rights referred to in [inter alia Article 15 GDPR, District Court] may be limited by means of a (…) legislative measure of a Member State applicable to the controller or processor, provided that such limitation does not affect the essential content of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to ensure: (…) the protection of the data subject or of the rights and freedoms of others;

The District Court is of the opinion that the defendants cannot refuse the requests for access, neither on the basis of the exception referred to in Article 15(4) GDPR, nor on the basis of an exception included in the Maltese implementing law. This opinion is based on the following considerations.

The interest on which Kindred and Risepoint essentially rely is the interest in not having to provide access to information that data subjects could use against them in legal proceedings. This is not an interest recognised under Union law as a ground for refusing data subjects access to their personal data.

Under Dutch law, this interest in civil law does not, in principle, stand in the way of the obligation to grant access.12 The Maltese exception ground invoked by the defendants also does not imply that they may refuse access to data subjects because the latter might use the information against them in legal proceedings (underlining in quote by the court):13 “While the GDPR allows for certain restrictions to data subject rights under national law, such limitations must be clearly justified. Regulation 4(e) of Subsidiary Legislation 586.09 provides that “[a]ny restriction to the rights of the data subject referred to in Article 23 of the Regulation shall only apply where such restrictions are a necessary measure required: (e) for the establishment, exercise or defence of a legal claim and for legal proceedings which may be instituted under any law”. However, any such restriction must be assessed strictly in light of Regulation 7 of the same legislation, which mandates that any limitation imposed must constitute a necessary and proportionate measure. For a restriction under Regulation 4(e) of Subsidiary Legislation 586.09 to be justified, the controller must demonstrate that it is strictly necessary to defend an actual legal claim or legal proceedings. A restriction cannot be based merely on the possibility that the data subject may initiate legal action following receipt of the information. A hypothetical or speculative rationale does not satisfy the legal threshold. Without clear and substantiated evidence of an existing or imminent legal claim, invoking Regulation 4(e) of Subsidiary Legislation 586.09 constitutes an unlawful interference with the right of access.”

The Maltese Data Protection Authority has rejected the defendants' reliance on this exception in similar cases.14 The fact that the defendants have appealed against these decisions does not mean that the court must interpret the Maltese exception differently than the Maltese Data Protection Authority.

The GDPR regulation already takes into account that processing access requests generates work for the responsible entrepreneur. Since the individual requests of the plaintiffs are not unusual, unnecessarily extensive, or complex, the balancing of interests referred to in Article 15(4) of the GDPR weighs in their favour over the business interests of the defendants.

The assertion that the plaintiffs are exercising the right of access with the sole intention of causing damage or nuisance to the defendants is unsubstantiated. Furthermore, no grounds for this assertion can be found in the file. Conclusion: the defendants must provide the plaintiffs with a copy of their transaction data

Finally, Kindred and Risepoint take the position that they are not obliged to provide the plaintiffs with a complete transaction overview, or at least not an overview containing data other than that provided by the plaintiffs themselves. This defense, too, cannot succeed. According to settled case law of the Court of Justice, the controller must, upon request, provide data subjects with a faithful and understandable reproduction of all data it processes concerning the data subject.15

The decision The court 6.1. orders Kindred to grant all claimants except Claimant 5 and Claimant 9 access to the personal data processed about them within four weeks of the date of this judgment, by providing each of the claimants with a copy of the personal data that constitute a complete picture of all direct or indirect transactions between the relevant claimant and Kindred, its legal predecessors and/or partners under the Unibet label; 6.2. orders Risepoint to grant each of the claimants access to the personal data processed about them within four weeks of the date of this judgment, by providing each of them with a copy of the personal data that constitute a complete picture of all direct or indirect transactions between the relevant claimant and Risepoint, its legal predecessors and/or partners under the Unibet label; 6.3. orders that the defendants must provide the data referred to above under 6.1 and 6.2 electronically in a common file format (such as XLS(X) or CSV) or by means of an Application Programming Interface, in such a manner that the information and data to be provided to the claimants are intelligible and that each of the claimants can verify, on the basis thereof, the accuracy of the personal data and the lawfulness of the processing of those data; 6.4. orders Kindred and Risepoint jointly and severally to pay a penalty of € 500 per claimant for each day that they fail to comply with the judgments referred to under 6.1, 6.2 and 6.3, with a maximum of € 10,000 per claimant; 6.5. orders Kindred and Risepoint jointly and severally to pay the legal costs, assessed on the part of the claimants at € 1,495, to be paid within fourteen days after notification thereof. If Risepoint and Kindred fail to comply with the judgments in a timely manner and the judgment is subsequently served, they shall pay an additional € 98 in ancillary costs, plus the costs of service; 6.6. orders Kindred and Risepoint jointly and severally to pay statutory interest as referred to in Article 6:119 of the Dutch Civil Code on the legal costs if these are not paid within fourteen days after notification; 6.7. declares this judgment provisionally enforceable; 6.8. dismisses any further or other claims. This judgment was rendered by Mr. C.J-A. Signed and pronounced in public on 27 May 2026. 1 Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), OJ EU 2016, L 119/1. 2 Implementing Act General Data Protection Regulation. 3 Delivered under case number: C/09/681584 / HA RK 25-133. 4 European Data Protection Board (EDPB), Guidelines 07/2020 on the concepts of “controller” and “processor” in the GDPR, Version 2.0 (7 July 2021), paragraph 12 and §2.1.2. 5 Article 4(7) of the GDPR states that the controller is the person who “alone or jointly determines the purposes and means of the processing of personal data”. 6 CJEU 29 July 2019, case no. C-40/17, ECLI:EU:C:2019:629 (Fashion ID), §65; CJEU 5 June 2018, C-210/16, EU:C:2018:388, §26 and 27 (Wirtschaftsakademie Schleswig-Holstein).

CJEU 26 October 2023, C-307/22, ECLI:EU:C:2023:811 (FT/DW), §72-75; CJEU 4 May 2023, C-487/21, ECLI:EU:C:2023:369 (Österreichische Datenschutzbehörde and CRIF), §32. Search assistance An extensive manual is available for searching for judgments, including explanations regarding: Search by date of judgment/publication Search by keywords Search by ECLI or LJN Search by area of law Finding locations for judgments Finding judgments at locations Selection criteria The Judiciary, the Supreme Court of the Netherlands, and the Council of State publish judgments based on selection criteria: Judgments in multi-judge chamber cases Judgments of the Supreme Court and appellate courts Judgments with media attention Judgments in criminal cases European law Guideline judgments Recusal Full selection criteria Weekly overview Select a week and view which judgments have been added to the judgment register in that week. Weekly overview of rulings English Sitemap Privacy Cookies Accessibility Spoofing Vacancies Archive Disclaimer Follow us twitter facebook facebook linkedin youtube Stay up to date rss email