Royal Dutch Lawn Tennis Association fined EUR 525k for sale of data

On 03/Mar/2020, De Koninklijke Nederlandse Lawn Tennisbond received a privacy fine of EUR 525,000. The enforcement authority (Dutch Data Protection Authority) has cited these legal provisions in imposing the fine on De Koninklijke Nederlandse Lawn Tennisbond: Article 5 GDPR/ Article 6 GDPR/ GDPR/

Essentials

Date of enforcement action:
03/Mar/2020
Jurisdiction: Fine imposed:
Netherlands Flag for Netherlands, which is the jurisdiction taking enforcement action EUR 525,000 (US$576,000)
Defendant company or entity: Industry segment:
De Koninklijke Nederlandse Lawn Tennisbond Associations /

Case summary

On March 3, 2020, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, the “Dutch DPA”) announced that it had imposed a €525,000 fine on the Royal Dutch Tennis Association (De Koninklijke Nederlandse Lawn Tennisbond, “KNLTB”) for an illegal sale of personal data.

Background

“The KNLTB is the national governing body of tennis in the Netherlands. It was constituted in 1899 in Amsterdam by 15 Dutch tennis associations as the Dutch Lawn Tennis Association and received the description “royal” upon its 40th birthday.” (Wikipedia)

In early 2018, the KNLTB announced in a newsletter and on its website its intention to provide personal data of its members to sponsors for targeted marketing purposes (by phone and by post). Members of the KNLTB subsequently informed the media and the Dutch DPA, and several members filed complaints with the Dutch DPA.

The Dutch DPA’s Decision

The Dutch DPA’s investigation revealed that:

  • The personal data of more than 350,000 KNLTB members were sold to sponsors for direct marketing purposes.
  • Although the collection of personal data by KNLTB from members was legally justified because it was necessary to participate in the membership program, the sale of such data to KNLTB’s sponsors could not take place based on the same legal ground, and members’ consent should have been collected by KNLTB.
  • The purpose for which personal data had been originally collected by KNLTB was not compatible with the subsequent sale of such data to KNLTB’s sponsors (i.e., the purpose limitation principle under the GDPR was not complied with). The Dutch DPA assessed this compatibility based on a number of factors, including the context in which the personal data was collected.

Ultimately, the Dutch DPA found that the sale of personal data by KNLTB to its sponsors was unlawful because it took place without a valid legal ground, therefore infringing Articles 5 and 6 of the EU General Data Protection Regulation. According to the Dutch DPA, this is a serious violation justifying the €525,000 fine. KNLTB has objected to the fine [effectively an appeal] and such objection will be assessed by the Dutch DPA.

(Hunton Andrews Kurth)

Commentary

It is possible that the Dutch authority considered the sale of data on such a large scale as emblematic and appropriate for enforcement action. It wrote that:

For any processing of personal data, the organization that processes it must be able to rely on one of the six principles of the GDPR. For example, that the person concerned has given permission for that processing. The sale of personal data without the permission of the person behind the data is usually prohibited. The KNLTB considered that it had a legitimate interest in selling the data. The Authority does not agree with this and has ruled that KNLTB had no basis for passing on those personal data to the sponsors.

The action may also signal the Authority’s view that legitimate interest cannot be relied upon for inherently commercial dealings with personal data, such as sale. Arguably, this is especially the case when the organization would have had the opportunity to obtain consent but failed to do so.

Applicable legal provisions

Enforcement information

Enforcement authority: Type of enforcement action:
Dutch Data Protection Authority Flag for Netherlands, which is the jurisdiction taking enforcement action Penalty notice
Subject to appeal?
Yes (the Royal Dutch Lawn Tennis Association will appeal)

File or case number

N/A

Acknowledgments

Hunton Andrews Kurth, for the case description.

Cite this fine in your work

Data Privacy Fines Index. (2020-03-03 06:13) Royal Dutch Lawn Tennis Association fined EUR 525k for sale of data. dataprivacyfines.com. Retrieved from https://privacyfines.com/fine/royal-dutch-lawn-tennis-association-fined-eur-525k/

Entry last updated: 2020-04-14 08:46 GMT.

Leave a Reply

Your email address will not be published. Required fields are marked *