Tennis association fined for selling members’ personal data
03-03-2020
The Personal Data Authority (Dutch DPA) has fined the Royal Dutch Lawn Tennis Association (KNLTB) €525,000 for unlawfully selling the personal data of more than 350,000 members to two sponsors.
In the summer of 2018, the KNLTB provided two sponsors with a large volume of personal data. One sponsor received personal data of 50,000 members and another sponsor received personal data of more than 300,000 members. The Dutch DPA subsequently received complaints from members who had been contacted by telephone for a promotional campaign. In October 2018, the Dutch DPA invited the KNLTB for a discussion, after which an investigation was launched.
Since 2007, the KNLTB has been collecting members' personal data in order to sell these on to sponsors to generate income. The KNLTB felt it had a legitimate interest in selling the data to third parties. The Dutch DPA considered that the data subject’s consent is usually required for the sale of personal data and that the KNLTB was not permitted to sell these personal data on the basis of the ‘legitimate interest' principle.
The Dutch DPA's investigation showed that prior to 2007, the KNLTB only collected personal data for the performance of the membership agreement. The KNLTB also sold these data on to the sponsors. The Dutch DPA was of the opinion that the purpose of collecting these data (the performance of the membership agreement) is not compatible with the purpose of providing the data to sponsors (generating income).
The Dutch DPA concluded that the sale of the personal data was contrary to the GDPR. Under the 2019 Fining Policy Rules, the Dutch DPA imposed a fine of €525,000. This sum is equal to the basic fine for this type of offence. The Dutch DPA saw no reason to increase or decrease the basic fine.
The KNLTB decided to object to this fining decision. The Dutch DPA will assess this objection.
This is a Legal Update by team Information Technology & Privacy.
