This article was published in 2020. Laws, case law and regulatory guidance may have changed since then. Contact us for up to date advice.
The Dutch privacy regulator, the Dutch Data Protection Authority (AP), has imposed a fine of 525,000 euros on the tennis association KNLTB. This fine was imposed for the sale of personal data by the KNLTB. In 2018, the KNLTB unlawfully provided personal data of its members to two sponsors in return for payment. This is evident from the AP’s fining decision.
Reason for the investigation
In early 2018, the KNLTB announced in newsletters and on its website that it would provide members’ personal data to sponsors so that they could approach members with ‘tennis-related and other offers’. For a number of KNLTB members, this was reason to submit a tip to the AP. In addition, a KNLTB member approached the media to publicly question whether the KNLTB’s new policy was in line with the (then forthcoming) GDPR.
In the summer of 2018, the AP also received complaints about the KNLTB. These concerned members who had been approached by telephone with a promotional offer, during which they were told that the promotion was in cooperation with the KNLTB. In early October 2018, a meeting took place between the KNLTB and the AP.
The tips and complaints from data subjects, the KNLTB’s communications, the media attention and the meeting prompted the AP to launch an investigation into the aforementioned practices of the KNLTB in October 2018.
Why did the AP take this up?
The Supervisory Framework 2018-2019 states that during these years the AP would focus in particular on trading in personal data. The AP believed, and still believes, that people must be able to trust that organisations do not pass on personal data without a legal basis.
Findings
The KNLTB stated that it had two reasons for providing personal data to sponsors, namely to add value to membership and to generate additional income to compensate for falling subscription income as a result of declining membership numbers.
On 11 June 2018, the KNLTB provided a sponsor with a file containing the address details of 50,000 members. Upon receipt, the sponsor forwarded this file to a company that printed the addresses on discount flyers and delivered the flyers to the members.
On 29 June 2018, the KNLTB provided another sponsor with a file containing members’ personal data. For more than three hundred thousand members, this file contained, among other things, their telephone number, email address, address details and date of birth. The sponsor was to use the data to approach 39,478 members by telephone with an offer. At the KNLTB’s request, the campaign was terminated early.
The decision to provide member data to sponsors was taken by the KNLTB in 2007 and at the end of 2017. In 2007 it was decided to provide member data for advertising by post, and at the end of 2017 for approaches by telephone/telemarketing.
In its report, the AP first established that the collection of the member data provided was lawful, because it was necessary in order to become a member of the KNLTB.
Members’ consent required
Secondly, the AP established in its investigation that the members had not given the KNLTB consent to pass on their personal data to the sponsors. Personal data may be processed if there is a legal basis for doing so. One of those legal bases is consent. Consent must be given by means of a clear affirmative act indicating that the data subject freely, specifically, in an informed manner and unambiguously agrees to the processing of personal data. That was not the case here.
Thirdly, the AP established that for part of the personal data, the purpose of collection was not compatible with the purpose of providing it to the sponsors. The AP assessed this compatibility on the basis of a number of factors, such as the context in which the personal data were collected. For the other part of the personal data provided, the AP established that the KNLTB should not have based the provision to sponsors on the legal basis of legitimate interest.
Avoid fines
Breaching the privacy rules can prove costly for your club, as the case above shows. So take the right measures in good time to safeguard your members’ privacy. Privacy Direct is happy to help you comply with the strict privacy rules in a practical and pragmatic way. Contact us without obligation; we are happy to think along with you.