On 27 July 2022, the highest administrative court in the Netherlands, published its highly anticipated judgment involving the Dutch Data Protection Authority’s assessment of “legitimate interest” under Article 6(1)(f) GDPR.
It was expected that the court would provide some clarification on whether “purely commercial interests” can qualify as legitimate interests within the meaning of Article 6(1)(f) GDPR with a potential to refer preliminary questions to the ECHR for clarification. Unfortunately, privacy professionals across Europe have been left empty handed. The court found that the controller had other legitimate interests which were not exclusively commercial that could be relied on. Hence, there was no need to consider the question of whether “purely commercial interests” could be a legitimate interest.
Background to the case
The appeal concerned a fine of EUR 575,000 issued by the Dutch Data Protection Authority ( the “Dutch Authority“) to VoetbalTV for unlawful processing. VoetbalTV is a video platform for amateur football. The company streams or records videos of matches on behalf of clubs and processes the personal data of (young) amateur footballers.
In its decision of July 2020, the Dutch Authority concluded that VoetbalTV’s processing of amateaur football’s personal data did not comply with Article 6(1)(f) GDPR since a legitimate interest could not be purely commercial in nature. In the Dutch Authority’s view, a legitimate interest cannot be broadly interpreted and should follow from the law.
VoetbalTV appealed the Dutch Authority’s decision and a lower Dutch court, ruled in favor of VoetbalTV in November 2020. The lower Dutch court confirmed that in its view, the Dutch Authority had applied the test for legitimate interest too narrowly. Yesterday’s case concerned the Dutch Authority’s appeal of this judgment.
The question of ‘purely commercial interests’
The judgment of the Dutch administrative court was of significant interest not just to Dutch domiciled companies but also controllers across Europe, because the first step of the (well-established) legitimate interests assessment[1] has not yet been considered from this angle.
The issue raised in this case was of such importance that the EU Commission recently published an open letter to the Dutch Authority setting out why in its view the Dutch Authority’s strict interpretation of Article 6(1)(f) was not inline with the GDPR, guidelines of regulators and the case of the CJEU.
Unfortunately, the Dutch administrative court was handed a ‘free pass’ in the form of additional legitimate interests raised by VoetbalTV which were not exclusively commercial in nature. Such interests were:
- the increase in the involvement and enjoyment of soccer fans
- the ability to perform technical analyses;
- offering friends and family members the opportunity to watch matches from a distance; and
- contributing to a higher level of privacy protection by preventing the recording of matches via other channels.
Therefore, the Dutch administrative court concluded in favor of VoetbalTV. It established that, with regard to the other interests stated by VoetbalTV there was now no question of a “purely commercial interest”. For this reason, the court was held that it did not have to answer the question and preliminary questions will not be referred to the CJEU.
What does this mean for those relying on commercial legitimate interests?
This much awaited ruling comes as somewhat of a disappointment, as it was hoped that it would bring some clarity on whether a purely commercial interest can be a “legitimate interest” for the purposes of Article 6(1)(f) GDPR.
Early alleged comments from the Dutch Authority imply that they still see the processing activities of VoetbalTV as unlawful, however, at the time of writing there has been no official commentary regarding the future of the Dutch Authority’s interpretation of “legitimate interests”.
In our view, controllers should note the open letter of the EU Commission in which the Commission highlighted that it was difficult to reconcile this strict interpretation with the intended effect of EU legislators. What is perhaps more significant is that the EU Commission reminded the Dutch Authority that just because a purely commercial interests is legitimate does not mean directly the controller can immediately rely on it – the second and third leg of the three-part legitimate interests test must apply.
Therefore, whilst controllers that relying legitimate interests as a lawful basis for processing should be continue to be clear and transparent about those interests, extra care should be taken to document the Legitimate Interests Assessment where those interests could be considered ‘commercial’.
For any questions relating to this decision or assistance with assessing legitimate interests, please contact Richard van Schaik, Partner or Francesca Pole, Associate – Data Protection – IPT Department DLA Piper Netherlands.
[1] Set out in Fashion ID No.C-40/17, ECLI:EU:C:2019:629