https://ploum.nl/uploads/Artikelen_en_Track_Records_en_expertise/Algemeen/thomas-lefebvre-gp8BLyaTaA0-unsplash.jpg

Is a commercial interest a legitimate interest?

07 Nov '22

The processing of personal data requires a legal basis, as mentioned in Article 6 of the General Data Protection Regulation (GDPR). Such a basis exists, for example, when consent is obtained for the processing of personal data, but also when the processing is "necessary for the protection of the legitimate interests" of the initiator of the processing (the data controller).

A legitimate interest of the controller can be anything. For example, one might think of sending e-mail newsletters but also of securing property. Not infrequently a company wishes to invoke a legitimate interest, in the context of its commercial activities. Such is the case with VoetbalTV and the KNLTB. The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP) has imposed hefty fines on both VoetbalTV and the KNLTB in this context.

The question whether a commercial interest can be a "legitimate interest" has been a point of discussion for some time now. Preliminary questions regarding this discussion have now been submitted to the Court of Justice of the EU. It is however expected that it is some time away before the CJEU will answer those questions. In this blog we will zoom in on the current situation. 

 

The AP's view on commercial interests

The AP is not quick to designate an interest to be a legitimate interest. The AP believes that the interest in question must be named in legislation or elsewhere in law as a legal interest. In addition, in its published view on legitimate interests, the AP explicitly excludes "merely serving purely commercial interests and profit maximization" from qualifying as a legitimate interest.

The European Data Protection Board (EDPB) has also commented on what it believes should be understood by the term "legitimate interest." The EDPB tends to interpret this term much more broadly than the AP. According to the EDPB, not only legal, but also all kinds of factual, economic and idealistic interests qualify as legitimate interest.

In addition, the Court of Justice has already confirmed several times that member states are not free to categorically exclude in advance reliance on the legitimate interest for certain categories of processing, and that the assessment of whether a particular interest is a legitimate interest must be tested negatively. The latter implies testing whether an interest is contrary to the law. Finally, the CJEU has also already ruled that Google may collect personal data from its commercial considerations (see CJEU Google Spain). It can also be argued under the GDPR itself that the term legitimate interest should be understood more broadly than the AP suggests. For example, recital 47 of the GDPR states that "direct marketing" is an example of a legitimate interest.

All in all, therefore, the AP's view on this point seems too narrow. In that context, the European Commission has already written a letter warning the AP that the strict interpretation of the GDPR endangers the internal market and hinders free enterprise. In doing so, the European Commission points out that commercial considerations can indeed be a legitimate interest.

VoetbalTV and the KNLTB both went to court because they disagreed with the fine imposed on them.

 

VoetbalTV

VoetbalTV provided a platform that allowed people to watch amateur soccer matches online. No prior consent was sought from the soccer players for filming the match, as VoetbalTV believed it had a legitimate interest in recording the matches. The AP believed this constituted a violation of Article 6 of the GDPR.

The Utrecht District Court ruled that the AP used too narrow a definition of the term "legitimate interest." The Court also considers that there is no question of a purely commercial interest on the part of VoetbalTV. As a result, the Court concludes that the AP used a wrong interpretation of the term "legitimate interest" and dismisses the fine. Next, the AP asks the highest administrative court for an opinion. Unfortunately, the highest administrative court did not rule on whether a purely commercial interest can be a legitimate interest. The highest administrative court ruled that VoetbalTV's interest is not purely commercial at all and thus does not get to the key question.

 

The KNLTB

In connection with roughly the same discussion as between VoetbalTV and the AP, the KNLTB also went to court. The Amsterdam District Court then took it upon itself to have this discussion settled once and for all by the European Court of Justice. It asked the Court of Justice to explain exactly how the term "legitimate interest" should be interpreted. On average, it takes 17 months for the Court of Justice to answer preliminary questions, so presumably we will have to be patient for a while.

 

What can you now base your processing on?

After reading this blog, it is understandable that you have doubts about whether you have chosen the right basis for your processing operations based on the legitimate interest. Unfortunately, there is no general answer to the question if this is legitimate. That will have to be assessed on a case-by-case basis. However, we do believe that in many cases a legitimate interest can be invoked. This always requires a certain balancing of interests, which can be recorded in an "LIA" (legitimate interest assessment). Sometimes other legislation is also relevant, such as the Telecommunications Act (spam ban) when sending a newsletter.

 

We are happy to help you with any questions regarding the possibility to invoke your legitimate interest as a processing ground, and assist in performing the aforementioned LIA. Please feel free to contact privacy@ploum.nl.

Contact

Attorney at law

Lars Boer

Expertises:  IT-Law, Privacy law, Procurement law, Cybersecurity , Technology, Media and Telecom, Commercial Contracts, Start-up and Scale-up,

Share this article

Stay up to date

Click on the plus and sign up for updates on this topic.

Expertise(s)

Met uw inschrijving blijft u op de hoogte van de laatste juridische ontwikkelingen op dit gebied. Vul hieronder uw gegevens in om per e-mail op te hoogte te blijven.

Personal data

 

Company details

For more information on how we use your personal information, please see our Privacy statement. You can change your preferences at any time via the 'Edit profile' link or unsubscribe via the 'Unsubscribe' link. You will find these links at the bottom of every message you receive from Ploum.

* This field is required

Interested in

Personal data

 

Company details

For more information on how we use your personal information, please see our Privacy statement. You can change your preferences at any time via the 'Edit profile' link or unsubscribe via the 'Unsubscribe' link. You will find these links at the bottom of every message you receive from Ploum.

* This field is required

Interested in

Create account

Get all your tailored information with a My Ploum account. Arranged within a minute.

I already have an account

Benefits of My Ploum

  • Follow what you find interesting
  • Get recommendations based on your interests

*This field is required

I already have an account

Benefits of My Ploum

Follow what you find interesting

Receive recommendations based on your interests

{phrase:advantage_3}

{phrase:advantage_4}


Why do we need your name?

We ask for your first name and last name so we can use this information when you register for a Ploum event or a Ploum academy.

Password

A password will automatically be created for you. As soon as your account has been created you will receive this password in a welcome e-mail. You can use it to log in immediately. If you wish, you can also change this password yourself via the password forgotten function.