This blog discusses two recent judgments concerning the limits of what a controller may do with the personal data it manages. The Court of Justice of the European Union (hereinafter: 'the Court') ruled that FIFA's publication of sanctions and transaction data relating to agents exceeds the boundaries of Article 6(1)(f) GDPR. The Administrative Jurisdiction Division of the Dutch Council of State (hereinafter: 'the Division') ruled in a case concerning the Fraud Signalling Facility of the Dutch Tax Authority that a controller must also include shielded digital environments in its search when handling an access request.
FIFA Football Agent Regulations and the GDPR: publication of sanctions and transaction data restricted
On 16 July 2026, the Court delivered its judgment in a case concerning the FIFA Football Agent Regulations (hereinafter: 'the FFAR'). The FFAR govern the activities of agents involved in the international transfer of football players and coaches. The judgment concerns the question of whether various rules of the FFAR are compatible with competition law, the freedom to provide services and the GDPR. In this blog, we discuss only the GDPR part of the judgment.
What happened?
The FFAR require agents to upload various information to a digital platform operated by FIFA. Part of that information is subsequently published by FIFA and made accessible to clubs, players, coaches and other agents. The two categories critically assessed by the Court are:
-
The publication of all sanctions imposed on agents and their clients under Article 19(d) FFAR, and
-
The publication of the details of all transactions involving agents, including the amounts of fees paid, under Article 19(e) FFAR.
The legal framework: legitimate interest
The Court establishes that the applicable legal basis is Article 6(1)(f) GDPR: processing on the basis of a legitimate interest. In accordance with settled case-law, the Court applies a three-part cumulative test: there must be a legitimate interest pursued by the controller or a third party, the processing must be necessary for that interest, and the interests or fundamental rights and freedoms of the data subject must not override the legitimate interest of the controller or of a third party.
The first requirement is in principle satisfied: FIFA has a legitimate interest in enforcing the FFAR and enabling other parties to comply with their obligations. However, the processing fails to meet the requirements of necessity and proportionality.
Publishing everything goes too far
Article 19(d) FFAR obliges FIFA to publish all sanctions imposed, regardless of the severity of the infringement, the harm caused or the time elapsed since the infringement. The Court acknowledges that the publication of sanctions may be justified in certain cases. Publication can serve as an effective sanction in itself and enable victims to seek compensation, but an indiscriminate publication obligation covering all sanctions, however minor, goes beyond what is necessary.
The Court makes an explicit distinction, however: the publication of agents' names and contact details, the identity of the clients they represent and the services provided to each client, as referred to in Article 19(a) to (c) FFAR, is considered in principle to be proportionate. That information is limited to what is necessary to enable the relevant parties to comply with their obligations under the FFAR and relates exclusively to the professional activities of the data subjects within a regulatory framework of which they, as professionals, are presumed to be aware.
Article 10 GDPR also plays a role in this context. Where a sanction is criminal in nature, an enhanced standard of protection applies: processing is only permitted under the control of an official public authority, or on the basis of an explicit legal basis in Union or Member State law. Neither condition is met here: FIFA is not a public authority, and the FFAR do not constitute a legal basis within the meaning of Article 10 GDPR.
Data minimisation
The obligation under Article 19(e) FFAR to publish the details of all transactions, including the amounts of fees paid to agents, is also considered by the Court to be incompatible with the GDPR. The wording of that provision is particularly broad, covering in principle all transactions involving agents. The scope of the processing is therefore insufficiently circumscribed to comply with the data minimisation principle of Article 5(1)(c) GDPR.
The Court adds that anonymised or aggregated information, such as an overview of average market rates, would in many cases be sufficient to promote market transparency without requiring the publication of individual transaction data per agent.
What does this judgment mean for practice?
This judgment demonstrates that the GDPR also applies to private organisations established outside the EU when they process personal data of data subjects located within the EU. For FIFA, this means that the publication obligations in the FFAR will need to be revised. Two lessons are relevant for broader practice:
-
Publication of sanctions requires differentiation. Anyone publishing sanctions must consider proportionality: how serious was the infringement, how long ago did it occur, and what purpose does publication serve? An all-encompassing publication obligation without distinction is likely to be incompatible with the GDPR.
-
Data minimisation applies to transparency obligations too. The fact that promoting market transparency is a legitimate processing purpose does not automatically justify the publication of all underlying data. Aggregated or anonymised information can in many cases be equally effective, while the interference with the privacy of data subjects is considerably smaller.
The Dutch Tax Authority, the data vault and the scope of the search obligation
On 30 September 2026, the Division delivered its judgment in a case concerning an access request submitted to the Dutch Tax Authority. The applicants had requested, on the basis of the right of access under Article 15 GDPR, access to all data processed about them in the Fraud Signalling Facility (FSV) and comparable systems. The central question in the judgment is how far the search obligation of a controller extends when handling an access request.
What happened?
The FSV was an application used by the Dutch Tax Authority to register risk signals and fraud reports. Following public reporting on the FSV, the applicants requested the Minister of Finance to provide access to all 'blacklists' on which they might be registered. The minister stated that their personal data did not appear in the FSV and that no comparable systems had been found. On that basis, he largely rejected the request.
The Division took cognisance on its own motion of information provided by the State Secretaries of Finance to the House of Representatives from April 2026 onwards concerning the so-called data vault at the Dutch Tax Authority: a shielded digital environment, set up in 2019, containing approximately 25 million files. External research by BDO revealed that the data vault contains files relevant to the FSV and the Risk Analysis Model (RAM), another system used by the Tax Authority to analyse fraud risks, and that multiple shielded digital environments exist within the Tax Authority that require further investigation. None of these environments had been included in the searches conducted in response to access requests from citizens.
An unreliable statement by the minister
The Division applies the principle that where a public authority states, following investigation, that certain personal data were not found, and that statement does not appear implausible, it is in principle for the applicant to demonstrate that the data do in fact exist. In assessing whether a statement is plausible, the Division takes into account the manner in which the investigation was conducted.
Because the data vault and other shielded environments should have been included in the searches carried out in response to the access request but were not, the Division considers that the minister's statement that the applicants' personal data do not appear in the FSV cannot be regarded as reliable without further justification. The minister must take a new decision and must include all databases, applications and systems in which fraud risk signals relating to individuals are or have been processed, including the contents of the data vault.
The scope of an access request must be interpreted broadly
The minister had interpreted the request narrowly by searching only in systems that, according to criteria developed by KPMG, were closely comparable to the FSV. The Division rejects this approach. A reasonable interpretation of an access request concerning 'blacklists' means that it covers all databases, applications and systems in which fraud risk signals relating to individuals are or have been processed. A controller may not unilaterally restrict the scope of its search by applying a definition that is considerably narrower than what the applicant reasonably intended.
What does this judgment mean for practice?
The judgment has implications that extend beyond the FSV affair. Every controller that processes personal data across multiple systems, including shielded or archived environments, must include all relevant systems in its search when handling an access request. It is not sufficient to search only the most obvious or actively used systems. Furthermore, the interpretation of the scope of an access request may not be unilaterally restricted by the controller. The applicant determines the scope of the request; the controller must interpret that scope reasonably and align its search accordingly. Organisations are well advised to review their access procedures for completeness, with particular attention to archives, shielded environments and systems that are no longer actively used but still contain personal data.
Would you like to read more of our Data & Privacy case law blog? View the previous blog via the link below.
/56.png?width=600&height=300&name=56.png)
/28.png?width=600&height=300&name=28.png)
/31.png?width=600&height=300&name=31.png)
