Following a two-year long investigation, the Dutch Data Protection Authority (AP) has issued a fine of 525.000€ on the Royal Dutch Lawn Tennis Association (KNLTB) for selling personal data of its members to third parties.
Which data was sold?
KNLTB sold personal data of a few hundred thousand of its members to two sponsors in exchange for a fee. The data consisted of i.e. name, gender and address so that members could be targeted with specific advertising via e-mail and telephone.
KNLTB Defense and AP’s response
KNLTB had invoked legitimate interest as a legal basis arguing that the selling of data would “create added value for membership”. This was rejected by the AP declaring legitimate interest to be an insufficient legal basis and that KNLTB therefore had no right to transfer its members’ personal data to the sponsors. The AP’s decision marks a significant step regarding the importance of GDPR adherence in the context of sport clubs and sport associations in the Netherlands. According to KNLTB’s Director of Services Robert Jan Schumacher, members benefit from the sharing of data and the resulting relevant offers. If data can no longer be sold, sport memberships may become more expensive.
KNLTB has stated that it will lodge an appeal against the fine.