Skip to main content
Praxikon

Enforcement

Dutch DPA and tennis federation KNLTB end litigation: fine cut from 525,000 to at most 250,000 euros

Date
Status
status not established
Body
Autoriteit Persoonsgegevens
Reference
AP persbericht 18 oktober 2025; oorspronkelijk boetebesluit 2019 (gepubliceerd 3 maart 2020), besluit op bezwaar; HvJ EU C-621/22 (arrest 2024)
Amount
€250,000

What it is about

In June and July 2018 the tennis federation KNLTB shared member data with a lottery organisation and a tennis shop, which then approached members with marketing. The DPA fined it 525,000 euros in 2019. In 2024 the Court of Justice held that the DPA had read legitimate interest too strictly: a commercial interest can qualify, but only under strict conditions. After talks the KNLTB admits the disclosure should not have happened that way and launches a privacy awareness campaign together with the DPA. The DPA cuts the fine to 250,000 euros minus the costs of the campaign and any other measures, with a final fining decision due by June 2026.

What this means in practice

A commercial interest can be a legal basis, but only if the processing is genuinely necessary, the intrusion is limited and people can reasonably expect it and are properly informed. Providing member data to sponsors for payment without that test remains a breach. Admission, cooperation and remedial measures can substantially cut a fine.

The GDPR articles concerned

Source: Autoriteit Persoonsgegevens, persberichtchecked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law8 of 11

Guidelines8 of 11

Enforcement and fines8 of 10

Legislation in motion6 of 7