Sanction RGPD Dutch Supervisory Authority for Data Protection (AP) — Royal Dutch Tennis Association ('KNLTB') : 525 k€ (2020)
- Autorité de contrôle
- Dutch Supervisory Authority for Data Protection (AP)
- Pays
- Pays-Bas
- Entreprise / secteur
- Royal Dutch Tennis Association ('KNLTB')
- Montant de l'amende
- 525 k€
- Date de la décision
- 3 mars 2020
- Fondement juridique
- Art. 5, Art. 6
- Manquement
- Base légale insuffisante pour le traitement
Résumé des faits
The Dutch Data Protection Authority has fined the Royal Dutch Tennis Association ('KNLTB') with EUR 525,000 for selling the personal data of more than 350,000 of its members to sponsors who had contacted some of the members by mail and telephone for direct marketing purposes. It was found that the KNLTB sold personal data such as name, gender and address to third parties without obtaining the consent of the data subjects. The data protection authority also rejected the existence of a legitimate interest for the sale of the data and therefore decided that there was no legal basis for the transfer of the personal data to the sponsors. ---UPDATE--- Following the CJEU's court ruling, the controller and the DPA agreed to settle the case and reduce the fine from EUR 525,000 to EUR 250,000. The controller also admitted their wrongdoing.