CJEU case C‑621/22 Koninklijke Nederlandse Lawn Tennisbond – CJEU Judgment (Netherlands, 2024)
CJEU judgment — not a DPA enforcement action
This is a Court of Justice ruling, not an enforcement action by a data protection authority. It is not included in cookie statistics or the Risk Calculator.
The Court of Justice ruled that a Dutch tennis federation improperly shared its members' personal data with sponsors for marketing without consent. This is important because it shows that organizations must have a valid reason to share personal information, or they could face penalties.
What happened
The tennis federation disclosed its members' personal data to sponsors without their consent.
Who was affected
Members of the tennis federation whose personal data was shared with sponsors for marketing purposes.
What the authority found
The Court found that the tennis federation violated GDPR by sharing personal data without consent or any other valid legal basis.
Why this matters
This case highlights the need for organizations to ensure they have proper consent before sharing personal data. It reinforces the idea that legitimate interests must be clearly defined and lawful.
GDPR Articles Cited
View original scraped data
Original data from scraper before AI verification against source document.
The controller is a tennis federation. Members of an affiliated tennis association, they automatically become a member of the tennis federation. In 2018, the controller supplied two of its sponsors (a Sporting equipment retailer and a online betting company) with the personal data of its members in exchange for money. The sponsors used the personal data for marketing purposes. After complaints were lodged by members of the controller with the Dutch DPA (Autoriteit Persoonsgegevens), itheld that the controller had violated Articles 6(1)(a) and (f) GDPR in combination with Article 5(1)(a) GDPR, as it had disclosed personal data without the consent of the data subjects or any other valid legal basis. The DPA purported that only an interest in law, with a legal basis can prove a legitimate interest under the GDPR and fined the controller €525,000. The controller brought an action against the DPA’s decision before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam) and argued that the disclosure of the personal data of its members was justified due to a legitimate interest as per Article 6(1)(f) GDPR. The legitimate interest is comprised of creating a close connection with the data subjects and being able to offer them discounts and offers from sponsors enabling them to play tennis at a more affordable price. In general, the controller argued that any interest, as long as it is not unlawful, can constitute a legitimate interest. On the 22 September 2022, the District Court requested a preliminary ruling by the CJEU since it had doubts as to the interpretation of legitimate interests under Article 6(1)(f) GDPR and so posed the following three questions to the CJEU: 1. How should the District Court interpret legitimate interests under Article 6(1)(f) GDPR? 2. Is it to be interpreted as encompassing only interests founded in law? 3. Can any interest classify as a legitimate interest as long as it is not unlawful? More specifically: can a purely commer
Outcome
CJEU Judgment
A judgment by the Court of Justice of the European Union, typically on a preliminary reference from a national court.
Related Cases (0)
No other cases found for CJEU case C‑621/22 Koninklijke Nederlandse Lawn Tennisbond in NL
This is the only recorded case for this entity in this jurisdiction.
Details
Judgment Date
4 October 2024
Authority
Court of Justice of the European Union
GDPRhub ID
gdprhub-cjeu-8346About this data
Cite as: Cookie Fines. CJEU case C‑621/22 Koninklijke Nederlandse Lawn Tennisbond - Netherlands (2024). Retrieved from cookiefines.eu
Last updated: