Court case 200.361.079/01 – Court Ruling (Netherlands, 2026)

The data subject submitted an access request, in electronic format, of his gambling data to Risepoint Limited (the controller), the operator of online gambling services in the Netherlands, pursuant to Article 15 GDPR. This was to allow the data subject to check its accuracy, whether processing was lawful and determine the amounts which were deposited and withdrawn from the service. The controller was willing to provide some data, however refused to provide transaction data, relying on Maltese data protection law. The data subject brought the issue to court. The Rotterdam District Court ordered the controller, to provide the data subject with his personal gambling data. The controller appealed on the grounds that the actual intentions behind the data subjects request were so that he could potentially bring a claim against the controller, and that the request was excessive under Article 12(5) GDPR. Furthermore, relying on Maltese data protection law which allows restriction of access in circumstances involving legal proceedings. The controller argued that disclosing the transaction data could affect potential litigation. Finally, the controller claimed that the requested electronic format requested by the data subject was not justified by Article 20 GDPR. The data subject on the other hand, argued that Article 15 GDPR should entitle him to access his gambling and transaction records as they constituted personal data. The data subject emphasised that a potential legal claim did not invalidate his rights under the GDPR, particularly, right to access. Moreover, the data subject addressed the controller’s reliance on Maltese law, however stated that such must still comply with Article 23 GDPR and satisfy the proportionality and necessity requirements. Finally, the data subject argued that the format requested would allow him to assess the accuracy of his records effectively. Primarily, the court rejected the controller’s argument that the data subject only made the access request to later bring a claim against them. Relying on the CJEU judgement C-307/22 (FT v DW), the court emphasised that a data subject may request access under Article 15 GDPR for purposes beyond merely understanding the processing operations, such as to establish liability. Thus, the court held that this does not constitute an abuse of their right. Moreover, the court rejected, the excessive nature of the access request by the data subject argument of the controller. The Court found that in such a context, a request may only be regarded as excessive where objective circumstances demonstrate that the purpose of the access request, pursuant to Article 15 GDPR is not being pursued and that the data subject is clearly manipulating the conditions. The Court found that the controller did not establish such grounds and emphasised that they cannot rely on the burden arising from their business model and large volume of access requests received onto a data subject. As regards the Maltese data protection law and the restrictions to access, the court rejected the controller’s argument, stating that Article 23 permits certain national restrictions however under the condition that the satisfy the principle of proportionality and necessity. A controller may not simply refuse access because the data may prove useful in legal proceedings, as such would undermine the ability of data subjects to verify the controller’s own records. Finally, the court found that the data subject’s request to receive his data in an electronically and usable format was valid. The court emphasised Article 12(5) GDPR which requires information to be provided electronically where such a request is made in the same manner. Thus, the court found no reason as to why numerical transaction records could not be given in the format requested. The controller ultimately incurred the litigation costs of a total of €1,841 which included the filing fee, lawyers’ salary and additional costs.