On Nov. 1, 2019, the Autoriteit persoonsgegevens (AP) published a norm explanation of the concept of "legitimate interest" from the AVG. The AP's norm explanation limits the possibilities of using this basis as a basis for processing personal data. Is this limitation justified?
An important basis for companies to process personal data is legitimate interest. After all, processing cannot always be based on a legal obligation or a contract. True, the controller could ask the data subject for consent, but that has all sorts of practical drawbacks. Fortunately, following Directive 95/46/EU, the AVG still offers the possibility of relying on "the legitimate interests of the controller or of a third party" (Art. 6(1)(f) AVG) (see, for example, the Rigas case of the European Court of Justice (recitals 28 and 29)).
Recital 47 to the AVG gives a number of examples of legitimate interests. Mentioned among them are fraud prevention and direct marketing: 'The processing of personal data for the purposes of direct marketing may be considered to be carried out for the purposes of a legitimate interest.'
These examples have not been in the AVG from the beginning. In Recital 39 (the predecessor of the current Recital 47) of the original AVG proposal of January 25, 2012, these examples were missing. During the discussion of the AVG proposal in the European Parliament in 2013, a battle ignited over the scope of legitimate interest. Some parliamentarians wanted it explicitly included that direct marketing constitutes a legitimate interest. Others just the opposite. Amendments Nos. 545 to 462 of the Committee on Civil Liberties, Justice and Home Affairs (LIBE) of March 6, 2013 reflect this discord. Finally, on Nov. 21, 2013, LIBE came up with a compromise proposal for a new Recital No. 39b to the AVG (Amendment 18): 'the processing of personal data for the purpose of direct marketing for own or similar products and services or for the purpose of postal direct marketing should be presumed as carried out for the legitimate interest of the controller'. In further negotiations between European Parliament, Council and Commission, the limitation proposed in the amendment to own or similar products and services lapsed and the current text of recital 47 emerged.
The condition for a successful invocation of the legitimate interest is that the interest is indeed a legitimate interest. It must be possible to demonstrate the necessity of the processing for that interest. It must also be verified that the interests of the data subject do not outweigh the interests of the data subject in not processing.
In addition to this balancing of interests in Art. 6(1)(f) AVG, the data subject is further protected by the relative right of objection from Art. 21 AVG against any processing based on the legitimate interest. This means that, even if in its generality there is a legitimate interest, that interest must still give way in individual cases if the data subject makes it plausible that his interest prevails because of his specific circumstances. Moreover, if direct marketing is involved, the data subject has an absolute right to object under Art. 21 AVG. In contrast to industry, the government cannot invoke the basis of justified interest in the context of its duties (final sentence of Art. 6 para. 1 AVG).
Art. 6(1)(f) AVG is the successor to Art. 7(f) of Directive 95/46/EU with which it is very similar. The Article 29 Working Party of the European Commission provided a nuanced interpretation of Art. 7(f) of Directive 95/46/EU in its opinion WP 217 of April 9, 2014. Given the striking similarity of Art. 6(1)(f) AVG to its predecessor, this opinion is still relevant. Opinion WP 217 is currently under review by the successor to the Art. 29 Working Party (the EDPB).
On June 25, 2018, in an opinion to billboard operators, the AP explained legitimate interest as follows: 'The first condition is whether the interest is legitimate. An interest can only be considered legitimate if the data controller can or must pursue this interest in a manner consistent with data protection and other legislation.'
In November 2019, in anticipation of the revision of WP 217, the AP published a new standard explanation with respect to legitimate interest. With respect to marketing, the norm explanation uses the ultimately rejected wording of the European Parliament in 2013 as a starting point. Indeed, the AP gives as an example of legitimate interest: 'to inform existing customers after a purchase about similar, own products or services'. It then additionally notes 'What also does not qualify as a legitimate interest is, for example: merely serving purely commercial interests, profit maximization (...).'
The space for direct marketing seems to be severely curtailed by this wording from the AP. Not surprisingly, the Data Driven Marketing Association (DDMA) expresses doubts on its website about this explanation of the norm. Moreover, regulators in other EU member states such as England and France also maintain a broader interpretation. See for this the opinions of ICO and CNIL. Leaving aside the question of whether the timing of the standard interpretation is fortunate, given the upcoming amendment to WP 217, textual questions can be raised about the wording. The wording is not entirely clear: "What also does not qualify as a legitimate interest is, for example: (...) monitoring the behavior of employees or the (buying) behavior of (potential) customers, etc., without a legitimate interest. In addition, the standard explanation seems contrary to recital 47 from the AVG.
Also, little attention seems to be paid to other fundamental rights, while the importance of fundamental rights is recognized by AP in the aforementioned opinion on billboards: 'If it concerns camera surveillance that is unavoidable to protect private property in public spaces, a basis under Article 6(1) f AVG may in principle arise. The legitimate interest in these circumstances concerns the necessary exercise of the fundamental right to protect property and/or health and/or family life.'
Direct marketing is never an end in itself for companies. Companies usually derive their right to exist from a profit objective, which, anchored in the right to entrepreneurship, is recognized in Article 16 of the European Charter of Fundamental Rights of the European Union. This fundamental right is explicitly mentioned in recital 4 of the AVG. Direct marketing is a means to that end. Moreover, the profit objective of the company runs like a thread through corporate and tax law.
In conclusion, there are reasonable doubts about a limited interpretation of legitimate interest as given in the AP's current standards explanation. Uncertainty about this widely used basis is undesirable. We are waiting for a uniform explanation from EDPB.
This article can also be found in the AVG file
