Add to My interests
07 Nov '22
The processing of personal data requires a legal basis, as mentioned in Article 6 of the General Data Protection Regulation (GDPR). Such a basis exists, for example, when consent is obtained for the processing of personal data, but also when the processing is "necessary for the protection of the legitimate interests" of the initiator of the processing (the data controller).
A legitimate interest of the controller can be anything. For example, one might think of sending e-mail newsletters but also of securing property. Not infrequently a company wishes to invoke a legitimate interest, in the context of its commercial activities. Such is the case with VoetbalTV and the KNLTB. The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP) has imposed hefty fines on both VoetbalTV and the KNLTB in this context.
The question whether a commercial interest can be a "legitimate interest" has been a point of discussion for some time now. Preliminary questions regarding this discussion have now been submitted to the Court of Justice of the EU. It is however expected that it is some time away before the CJEU will answer those questions. In this blog we will zoom in on the current situation.
The AP is not quick to designate an interest to be a legitimate interest. The AP believes that the interest in question must be named in legislation or elsewhere in law as a legal interest. In addition, in its published view on legitimate interests, the AP explicitly excludes "merely serving purely commercial interests and profit maximization" from qualifying as a legitimate interest.
The European Data Protection Board (EDPB) has also commented on what it believes should be understood by the term "legitimate interest." The EDPB tends to interpret this term much more broadly than the AP. According to the EDPB, not only legal, but also all kinds of factual, economic and idealistic interests qualify as legitimate interest.
In addition, the Court of Justice has already confirmed several times that member states are not free to categorically exclude in advance reliance on the legitimate interest for certain categories of processing, and that the assessment of whether a particular interest is a legitimate interest must be tested negatively. The latter implies testing whether an interest is contrary to the law. Finally, the CJEU has also already ruled that Google may collect personal data from its commercial considerations (see CJEU Google Spain). It can also be argued under the GDPR itself that the term legitimate interest should be understood more broadly than the AP suggests. For example, recital 47 of the GDPR states that "direct marketing" is an example of a legitimate interest.
All in all, therefore, the AP's view on this point seems too narrow. In that context, the European Commission has already written a letter warning the AP that the strict interpretation of the GDPR endangers the internal market and hinders free enterprise. In doing so, the European Commission points out that commercial considerations can indeed be a legitimate interest.
VoetbalTV and the KNLTB both went to court because they disagreed with the fine imposed on them.
VoetbalTV provided a platform that allowed people to watch amateur soccer matches online. No prior consent was sought from the soccer players for filming the match, as VoetbalTV believed it had a legitimate interest in recording the matches. The AP believed this constituted a violation of Article 6 of the GDPR.
The Utrecht District Court ruled that the AP used too narrow a definition of the term "legitimate interest." The Court also considers that there is no question of a purely commercial interest on the part of VoetbalTV. As a result, the Court concludes that the AP used a wrong interpretation of the term "legitimate interest" and dismisses the fine. Next, the AP asks the highest administrative court for an opinion. Unfortunately, the highest administrative court did not rule on whether a purely commercial interest can be a legitimate interest. The highest administrative court ruled that VoetbalTV's interest is not purely commercial at all and thus does not get to the key question.
In connection with roughly the same discussion as between VoetbalTV and the AP, the KNLTB also went to court. The Amsterdam District Court then took it upon itself to have this discussion settled once and for all by the European Court of Justice. It asked the Court of Justice to explain exactly how the term "legitimate interest" should be interpreted. On average, it takes 17 months for the Court of Justice to answer preliminary questions, so presumably we will have to be patient for a while.
After reading this blog, it is understandable that you have doubts about whether you have chosen the right basis for your processing operations based on the legitimate interest. Unfortunately, there is no general answer to the question if this is legitimate. That will have to be assessed on a case-by-case basis. However, we do believe that in many cases a legitimate interest can be invoked. This always requires a certain balancing of interests, which can be recorded in an "LIA" (legitimate interest assessment). Sometimes other legislation is also relevant, such as the Telecommunications Act (spam ban) when sending a newsletter.
We are happy to help you with any questions regarding the possibility to invoke your legitimate interest as a processing ground, and assist in performing the aforementioned LIA. Please feel free to contact firstname.lastname@example.org.
Expertises: IT-Law,Privacy law,Procurement law,Cybersecurity , Technology, Media and Telecom, Commercial Contracts,
Expertises: IT-Law,Privacy law,Cybersecurity ,Marketing and Advertising, Food,Health Care & Life Sciences, E-health,E-commerce,
17 Mar 23
16 Mar 23
10 Mar 23
09 Mar 23
24 Feb 23
20 Feb 23
16 Feb 23
13 Feb 23
03 Feb 23
26 Jan 23
06 Jan 23
02 Jan 23
Met uw inschrijving blijft u op de hoogte van de laatste juridische ontwikkelingen op dit gebied. Vul hieronder uw gegevens in om per e-mail op te hoogte te blijven.
Stay up to date with the latest legal developments in your sector. Fill in your personal details below to receive invitations to events and legal updates that matches your interest.
*This field is requiredI already have an account
Follow what you find interesting
Receive recommendations based on your interests
We ask for your first name and last name so we can use this information when you register for a Ploum event or a Ploum academy.
A password will automatically be created for you. As soon as your account has been created you will receive this password in a welcome e-mail. You can use it to log in immediately. If you wish, you can also change this password yourself via the password forgotten function.