The Dutch Autoriteit Persoonsgegevens AP) must decide within eight weeks on a request to take enforcement action against the cashless policy of a movie theater in Arnhem. This was ruled Raad van State by the Administrative Law Division of the Raad van State . According to the highest administrative court, the AP has not sufficiently substantiated why making debit card payments mandatory does not violate the privacy rules set out in the General Data Protection Regulation (GDPR).
The case was brought by a resident of Gelderland who, since 2018, has been unable to pay for cinema tickets in cash at the Arnhem film theater. Following a relocation, the theater now only accepts debit or credit card payments, both at the box office and in the catering facilities.
The man claimed that this forced him to share personal data, such as his bank account number and payment details. In his opinion, this was an unnecessary infringement of his right to privacy. He therefore requested the AP to take action against the cinema on the basis of the GDPR.
The privacy regulator rejected that request. According to the AP, it was not plausible that refusing cash was in violation of the GDPR.
The Gelderland District Court previously ruled in favor of the AP, but the Raad van State now Raad van State that ruling. The essence of the ruling is that the AP did not sufficiently investigate and justify whether the purpose of the data processing—increasing employee safety—was justified in this specific case.
The movie theater argued that not accepting cash reduces the risk of robberies and thus increases the safety of employees, many of whom are volunteers. According to the Raad van State , "(social) safety" Raad van State , in principle, be a legitimate objective under the GDPR.
However, in this specific case, according to the highest administrative court, it has not been demonstrated that security was actually at stake or that the abolition of cash would have a significant effect. "The mere fact that cash is susceptible to theft is insufficient in itself," according to the ruling.
Since it has not been established that there is a legitimate purpose, the Raad van State address the question of whether the processing of personal data is necessary and proportionate.
The appellant had also argued that "special personal data" might be processed, for example because film choices could reveal political or sexual preferences. The Raad van State that argument.
For debit card payments, the cinema—via an external payment service provider—only processes the last four digits of the bank account number (known as PAN masking), the payment amount, and the date. There is no evidence that the film for which a ticket was purchased is recorded. According to the Raad van State , this data Raad van State not indicate that special personal data is being processed within the meaning of Article 9 of the GDPR.
The argument that there is no valid agreement because visitors have no choice in terms of payment method is also unsuccessful. According to the Raad van State , the purchase of a ticket or refreshment simply Raad van State an agreement. The question of whether that agreement is valid under civil law must be contested in civil court, if necessary.
The Raad van State the appeal well-founded, overturns the AP's previous decision, and instructs the supervisory authority to take a new decision within eight weeks. In doing so, the AP must provide better justification as to whether the objective of mandatory debit card payments is actually justified under the GDPR.
The new decision may only be appealed directly to the Raad van State.
The ruling may have broader implications for businesses that operate entirely cashless. Although the Raad van State rule that mandatory debit card payments are inherently contrary to the GDPR, it emphasizes that organizations must provide concrete justification for why they process personal data and why less intrusive alternatives—such as continuing to accept cash—are not sufficient.
The case thus emphasizes that even seemingly everyday choices, such as rejecting cash, require careful consideration in terms of privacy law.
This summary was partly generated using AI based solely on the ruling in the Rechtspraak database.
