Introduction
The subject of “legitimate interests” and in particular whether they can be “purely commercial” has been a topic of front and center stage debate in the Netherlands for some time. The Dutch data protection authority (AP) has historically interpreted the concept of legitimate interest narrowly, taking the position that organisations cannot rely on purely commercial interests as a legitimate interest and that instead, the interests must have a basis in law. This narrow interpretation makes it impractically difficult for organisations to rely on Article 6(1)(f) GDPR as the lawful basis on which to process personal data and created uncertainty.
Now, following preliminary questions from the Amsterdam district court, the Court of Justice of the European Union (CJEU) has provided valuable clarification – and one that allows organisations to breathe a sigh of relief. In its judgement of 4 October 20024, the CJEU recognized that a wide range of interests can be considered a ‘legitimate interest’ under the GDPR and there is no requirement that the interests of the controller are laid down by law. While the CJEU decided not to answer the specific preliminary questions received from the Amsterdam district court, the attitude of the CJEU is clear: “legitimate interests” can serve purely commercial interests.[1]
Setting the scene: AP’s historic viewpoint on legitimate interest
The AP has applied its narrow interpretation of the concept of legitimate interests for many years.[2] This position is also reflected in the AP’s enforcement actions. Including:
- Royal Dutch Tennis Association (KNLTB): The foundation of the referring case from the Amsterdam district court began in 2019 when the AP imposed a fine of EUR 525,000 on KNLTB for unlawfully sharing personal data of its members with two sponsors for marketing purposes, in return for payment. The AP concluded that the KNLTB could not rely on their legitimate interests as the interest was solely of a commercial nature. According to the AP, legitimate interests must “belong to the law, being lawful, enshrined in a law” and the interests claimed by KNLTB were lacking this.
- VoetbalTV: In 2020, the AP also issued a fine of EUR 575,000 to VoetbalTV for processing personal data on the basis of a purely commercial legitimate interest – please see our previous blog here.
The AP has consistently upheld their interpretation despite heavy criticism, including from the European Commission who raised their concerns on the AP’s strict interpretation in an open letter. According to the European Commission, the interpretation severely limits businesses’ possibilities of processing personal data for commercial interests.
The Dutch courts have also weighed in. In the VoetbalTV case the district court Midden-Nederland (perhaps boldly) concluded that the AP misinterpreted the concept of legitimate interest. The court ruled that the fact that VoetbalTV has a commercial interest does not mean that they have no legitimate interest, and excluding a particular interest as a legitimate interest in advance is contrary to European case law. However, in appeal, the Netherland’s highest appellate court was unable to ‘resolve’ this difference of opinion on the basis that there were other relevant legitimate interests that weren’t exclusively commercial in nature. Hence, while the court ruled in favour of VoetbalTV, the judgment did not yet clarify the use of legitimate interests as a legal basis for purely commercial interests.
CJEU judgment 4 October 2024
The KNLTB case has been brought before the Amsterdam district court[3], which turned to the CJEU for guidance in September 2022. The court referred preliminary questions to the CJEU to explain how the term “legitimate interest” should be interpreted. Should this be interpreted in such a way to include exclusively interests established in law, or can any interest be a legitimate interest provided that such interest does not conflict with the law? More specifically: can a purely commercial interest and the interest of the matter at hand (i.e., sharing personal data with a third party against payment without consent of the data subject) be regarded as legitimate interest? And if so, under what circumstances?
The CJEU chose not to answer these direct questions and reframed them based on the facts of the KNLTB case. However, regardless of this approach, the view of the CJEU is clear.
The CJEU reiterates the 3-step test to assess whether the legitimate interest can be used as lawful basis: (1) a legitimate interest should be pursued, (2) there must be a need to process personal data, and (3) the interests or fundamental freedoms and rights of the person(s) concerned should not override the legitimate interests.
The CJEU’s judgement on the first step is most crucial to the above-mentioned debate. At this step, the CJEU ruled that (i) a wide range of interests may be regarded as legitimate; and (ii) there is no need that the interest is provided for by law (but, of course, the legitimate interest should be lawful). Hence, commercial interests, such as the interest pursued by KNLTB, can also be legitimate interests.
It is now up to the Amsterdam district court to assess, based on the specifics of the KNLTB case, whether such a legitimate interest exists in that case and whether the second and third conditions are also met. In our view, given the facts of the KNLTB case and the CJEU’s remarks on the second and third conditions, it is unlikely that the commercial interests of KNLTB will pass the 3-step test. However, this does not detract from the (long awaited) clarification on the scope of what can be considered a “legitimate interest”.
Impact on Dutch businesses
The CJEU judgment is the final act in the heavily criticized strict interpretation of the AP on “legitimate interests”. While this judgment will not save VoetbalTV (which went bankrupt during the dispute with the AP) and might not save KNLTB either, this is a welcome development for other Dutch business.
[1] Judgement CJEU 4 October 2024, C-621/22 (Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens)
[2] AP-normuitleg grondslag gerechtvaardigd belang | Autoriteit Persoonsgegevens.
[3] ECLI:NL:RBAMS:2022:5565, Rechtbank Amsterdam, 20/4850 (rechtspraak.nl)
[View source.]
