Kindred Group Limited – Court Ruling (Netherlands, 2026)

The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1 October 2021. At that time, the relevant websites were operated by Risepoint Limited, formerly Trannel International Ltd (the controller). Kindred Group Limited had previously been the parent company of Risepoint. The data subjects had authorised Dynamiet Nederland B.V., a commercial legal services provider, to act on their behalf in matters relating to gambling losses (hereinafter, Dynamiet). The authorisation expressly included submitting access requests under Article 15 GDPR concerning account and transaction data held by online gambling providers. Between December 2024 and January 2025, the data subjects, acting through Dynamiet, submitted access requests to the controller under Article 15 GDPR. They requested, among other things, their personal data, account and contractual information, financial transactions and detailed information concerning their gambling activity. The controller did not provide the requested data. The data subjects subsequently brought proceedings seeking an order requiring the controller to provide the requested information. They also requested a penalty payment in the event of non-compliance. The controller argued, among other things, that the claims should not be examined because of Maltese legislation restricting certain GDPR rights and because the requirements of Article 80(1) GDPR were not fulfilled. The Court held that Maltese Subsidiary Legislation 586.09 did not automatically justify refusing an Article 15 GDPR access request. Although Article 23 GDPR allows certain restrictions on data subject rights, such restrictions must still be necessary and proportionate. The controller had also failed to demonstrate that the requests were abusive or excessive. However, the Court did not assess whether Article 15 GDPR had been infringed. It found that Dynamiet was effectively conducting the proceedings on behalf of the data subjects. This followed from the broad authorisations granted to it and from its role during the proceedings. The Court held that Article 80(1) GDPR permits an organisation to act on behalf of data subjects only where it fulfils the conditions laid down in that provision. Dynamiet did not meet those requirements, in particular because it operated for profit. The claims were therefore declared inadmissible under Articles 79 and 80(1) GDPR. The Court also held that other fundamental rights could not be relied on to circumvent Article 80(1) GDPR. It therefore did not rule on the substance of the access requests. No fine or corrective measure was imposed, and the data subjects were ordered to pay the procedural costs.