At the end of December 2019, the Dutch Data Protection Authority imposed a fine of 525,000 euros on the KNLTB. This was for passing on members’ personal data to sponsors. They approached the members with tennis-related offers. According to the AP, this was an “unlawful sale of personal data.” The tennis federation had no basis to sell this personal data without the consent of the data subject, according to the AP. The tennis federation invokes legitimate interest. Membership numbers are declining, and the federation must be inventive to continue to generate income. These revenues support tennis in general and top-level tennis in particular. The Tennis Federation held a member consultation on this topic in 2007, and again in 2017, the members’ council agreed to the provision of personal data to third parties for direct marketing. Since 2015, new members have received a welcome email clearly explaining how their personal data is handled, and new members can object to this. A careful selection of members was also made in advance (do-not-call register, objections made to provision to third parties), leaving approximately 20,000 members who were approached by the partners.
The AP notes that the data was provided to third parties without consent and considers this “further processing of data no longer compatible with the purpose for which it was provided” (purpose limitation). This processing cannot be permitted on the basis of legitimate interest. A purely commercial interest is diametrically opposed to the interest of data subjects in maintaining control over their data. In the opinion of the AP, this purely commercial interest is not sufficiently urgent to be considered “legitimate.”
The KNLTB feels ambushed by this sky-high fine and considers it disproportionate. The AP should have first issued a warning via a norm-correcting letter instead of enforcing. The AP’s interpretation of the basis “legitimate interest” is far too strict/limited compared to the explanatory notes to the GDPR. The KNLTB invokes freedom of entrepreneurship. The KNLTB has appealed. We will keep you informed of the follow-up.
See the following link for the AP’s fine decision: https://www.autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/boetebesluit_knltb.pdf
