Court case 8 O 203/24 – Court Ruling (Germany, 2026)

A German user (the data subject) brought court proceedings against two online gambling service providers (the controllers) established in Malta. They offered online casino games and sports betting services that were accessible to everyone in Germany. The data subject requested access to the data concerning him processed by the controllers in April 2024. He wanted to obtain certainty about the lawfulness of the processing of his data and determine the extent of his gambling behaviour as well as the claims to which he was entitled against the controllers. The data subject claimed in court that the controllers had not fulfilled his access request and should therefore be ordered to jointly and severally provide him access to his complete gaming and transaction data pursuant to Articles 15(1) and 15(3) GDPR. The controllers stated that they had already provided the data subject access to the information he had requested and stated that the action should be dismissed. The court held in a partial judgment that the action was admissible and largely justified. In order to pay winnings to the data subject, the controllers inevitably had to verify his identity and thus process his personal data. The court ordered the controllers to provide the data subject information about the personal data processed in context of the customer relationship, particularly data concerning the data subject’s gaming history and all transactions on his gaming accounts. The access request was not manifestly unfounded or excessive within the meaning of Article 12(5) GDPR. The court also held the controllers had not previously provided the data subject access to the required information in accordance with Articles 15(1) and 15(3) GDPR. However, the controllers were legally independent and did not operate the online gambling websites jointly. Therefore, the obligation to fulfil the access request was to be limited to their individual websites.