The Netherlands

Royal Dutch Tennis Association ("KNLTB")

525,000 €

GDPR enforcement action by Dutch Supervisory Authority for Data Protection (AP) on 2020-03-03.

Rank · Sector

of 351 in Individuals and Private Associations

Rank · The Netherlands

#15

of 43

Rank · All fines

#232

of 3,050

Case details

Authority: Dutch Supervisory Authority for Data Protection (AP)
Date: 2020-03-03
Controller / Processor: Royal Dutch Tennis Association ("KNLTB")
Sector: Individuals and Private Associations
Quoted Articles: Art. 5 GDPR, Art. 6 GDPR
Type of violation: Insufficient legal basis for data processing

Summary

The Dutch Data Protection Authority has fined the Royal Dutch Tennis Association ("KNLTB") with EUR 525,000 for selling the personal data of more than 350,000 of its members to sponsors who had contacted some of the members by mail and telephone for direct marketing purposes. It was found that the KNLTB sold personal data such as name, gender and address to third parties without obtaining the consent of the data subjects. The data protection authority also rejected the existence of a legitimate interest for the sale of the data and therefore decided that there was no legal basis for the transfer of the personal data to the sponsors.
---UPDATE---
Following the CJEU's court ruling, the controller and the DPA agreed to settle the case and reduce the fine from EUR 525,000 to EUR 250,000. The controller also admitted their wrongdoing.

Open original source Links to the regulator's original publication or another source.