Second fine under the AVG imposed: how to avoid it?

Since the General Data Protection Regulation (hereinafter AVG) came into force in 2018, the Personal Data Authority (hereinafter AP) has received thousands of complaints regarding privacy violations. In 2019, the AP has announced that it will investigate more frequently in response to complaints and impose sanctions more often when a violation is found. The AP seems to be delivering on this promise by recently imposing its second AVG fine (in the amount of €525,000.00) on the Royal Dutch Lawn Tennis Association (hereafter: KNLTB).

Why a fine?

The KNLTB had sold personal data of 350,000 members to sponsors. These members were then approached by mail or phone, while they had no knowledge of this. According to the AP, there was no basis under the AVG for the sale of the personal data. Thus, the members had not given their consent for providing their data to sponsors. For more on this, see colleague Jarno Smit's extensive blog.

How can you avoid a fine?

First of all, it is important to explicitly define in advance the purposes for which personal data are collected and processed. Personal data should only be collected for a legitimate purpose and to the extent necessary. Importantly, as little data as possible should be collected in order to achieve the predetermined purpose.

If, as an organization, you then find out that you want to use data for a purpose other than that for which it was collected, as in the example of the KNLTB, in most cases permission must be sought from the data subjects to use the data for the intended (second) purpose. So again, it is important here that as little personal data as possible is used.

Want to know more about the possibilities or just want to spar? Let us know!