Menu

Filter by
content
PONT Data&Privacy
  • PONT home
    • mill

    0

    AVG| Legitimate interest
    In sommige gevallen is het mogelijk om het gerechtvaardigd belang als grondslag voor persoonsgegevensverwerking te gebruiken. Dit vereist een zorgvuldige argumentatie aan de hand van de driestappentoets van artikel 6 lid 1 sub f van de AVG, ook wel een Legitimate interest assessment (LIA) genoemd.

    FootballTV: on the what, why and how to move forward

    The legitimate interest is perhaps the most frequently used processing ground offered by the AVG. Especially if you don't want to tire your customers or data subjects with endless consent requests, invoking the legitimate interest can, under circumstances, offer a solution. But how far does the scope of this processing basis extend? When can it be invoked, and when should consent really be sought? In practice, this is a consideration that often has to be made on a daily basis. And for making that consideration, the ruling by the Council of State last week on Football TV is important.

    Vonne Laan

    Aug. 1, 2022

    Background articles

    Background articles
     

    Why does this case matter?

    The FootballTV verdict is of interest because it deals with two controversial principles the AP uses in applying the legitimate interest test:
    1. Purely commercial interests do not qualify as legitimate interests.
    2. Only interests that have a legal basis are eligible to qualify as legitimate interests; they must be "interests that are named as a legal interest in (general) law or elsewhere in law."

    What preceded it?

    On November 1, 2019, the Personal Data Authority (AP), published the Norm Explanation Basis of Justified Interest (1). In this norm explanation, the AP explains how it interprets this processing basis. The standards explanation shows when, according to the AP, organizations can invoke the legitimate interest, and when they cannot. However, the standards explanation has been controversial from the beginning. This national interpretation of the standard gives a much narrower interpretation of the basis than the earlier opinion on the subject at the European level: Opinion 06/2014 of all national privacy supervisory authorities together, as united in the Article 29 Working Party at the time, and now the European Data Protection Board (2). And although an update of the opinion has been announced (3), it has been postponed time and again, and Opinion 06/2014 is, for now, what we have to make do with at the European level. The opinion at the European level seems to imply that commercial interests - under circumstances - can perfectly well qualify as legitimate interests. In the context of the impact that the processing has on the data subjects, the following should be taken into account, among other things: "The manner in which the data are processed, including whether or not the data are made public or otherwise accessible to a large number of individuals or whether large amounts of personal data are processed in combination with other data (e.g., in the case of profiling, for commercial, law enforcement or other purposes)." Nowhere in this opinion is it stated that the legitimate interest cannot be invoked when purely commercial interests are involved. And although the opinion does consider it relevant whether an interest also has a basis in (national) law, this is not a requirement to qualify as a legitimate interest. This is different in the AP's standard explanation. In it, it reads, among other things, "What also does not qualify as a legitimate interest is, for example: merely serving purely commercial interests, profit maximization, following the behavior of employees or the (buying) behavior of (potential) customers without a legitimate interest, etc." In addition, the AP states that only interests that have a legal basis qualify as legitimate interests: "The first condition is that the interests of the controller or a third party qualify as legitimate. This means that those interests have been named in (general) legislation or elsewhere in the law as a legal interest. An interest that is also protected in law, that is considered worthy of protection and that in principle must be respected and can be 'enforced'." Is it crazy that the AP goes so much further in its interpretation of legitimate interest? Yes very crazy. So crazy, in fact, that the European Commission previously sent a letter to the AP about this. This letter has recently come into the hands of the NRC, and according to the NRC, this letter states that, according to the European Commission, the AP's strict interpretation hinders free enterprise (see the NRC of July 4 on this subject). A profit motive can never be the only reason to deny companies a reliance on the legitimate interest. The European Commission further points out, among other things, that Google has previously been allowed by European courts to collect personal data from Internet users, under conditions, from commercial considerations. The AP is therefore "invited" to change its position. However, from the response to the European Commission - also in NRC's possession - it appears that the invitation will not be used. And so until a judge intervenes, we in the Netherlands are still stuck with the AP's - to put it mildly - awkwardly applicable standards explanation. But is the soup being eaten as hot as it is being served, you might ask? "Yes," as it turns out. In FootballTV, among other cases, the AP actually applied its strict standards explanation in imposing a fine.

    What is the FootballTV case about?

    SoccerTV was a video platform for amateur soccer. FootballTV was commissioned by soccer clubs to make video recordings of matches in amateur soccer. The FootballTV platform allowed people to watch soccer moments back and analyze matches. Thus, amateur soccer players could watch matches back with friends and family, and coaches could also use FootballTV. For making and offering the video recordings, FootballTV invoked legitimate interest. However, according to the AP, this could not pass muster. By decision of July 16, 2020 (not published), the AP therefore fined VoetbalTV EUR 575,000 for unlawful processing of personal data, referring to the AP's standard explanation. The AP takes the position that FootballTV does not have a legitimate interest in this case because its interest is purely commercial in nature. That is not an interest enshrined in law and therefore cannot be qualified as legitimate, according to the AP. However, Football TV could not agree with this penalty decision by the AP, and went to court.

    What did the court rule?

    On November 23, 2020, the Central Netherlands District Court ruled in favor of VoetbalTV (4). The court does not explicitly address the question of whether an exclusively commercial interest can serve as a legitimate interest. However, the court does address the question of whether only interests with a legal basis can qualify as a legitimate interest. The court disagrees. A negative test must be assumed: interests that are contrary to the law cannot serve as a legitimate interest. By doing so, the court indicates that the AP's positive test - in which only interests with a legal basis are considered - cannot pass. The court's conclusion is adamant: "In summary, the court concludes that the defendant's [the AP's] review in this case is based on a misinterpretation of the term 'legitimate interest' and therefore violates Article 6(1)(f) of the AVG." However, the AP did not resign itself to this: the AP appealed this ruling to the Council of State.

    What did the Council of State judge?

    On July 27, 2022, the Council of State, Administrative Law Division, upheld the court's ruling (5). Like the court, however, the division did not rule on whether a purely commercial interest could qualify as a legitimate interest. Nor did the division ask preliminary questions on this issue, as requested by the AP. Indeed, the department agreed with the court that FootballTV was also pursuing other interests that were not commercial in nature, and that therefore a purely commercial interest did not apply. Therefore, the question of whether a purely commercial interest in itself can function as a legitimate interest need not be answered. Therefore, the Division sees no need for preliminary questions.

    How to move forward?

    It is clear that the AP's explanation of standards cannot pass the positive test, where only interests with a legal basis can be considered. Instead, a negative test should be used: interests that conflict with the law cannot serve as legitimate interests. However, it is still not clear whether purely commercial interests can now serve as a legitimate interest, or not. Perhaps this will be clarified in the ruling expected on the fine the AP imposed on the KNLTB (6) (7). Until that time, it seems advisable in any event, when relying on the legitimate interest, to frame the interests in such a way that they are not seen as purely commercial.

    1. https://autoriteitpersoonsgegevens.nl/sites/default/files/atoms/files/normuitleg_gerechtvaardigd_belang.pdf

    2. https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf

    3. https://edpb.europa.eu/sites/default/files/files/file1/edpb-2019-02-12plen-2.1edpb_work_program_en.pdf

    4. https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RBMNE:2020:5111

    5. https://uitspraken.rechtspraak.nl/inziendocument?id=ECLI:NL:RVS:2022:2173

    6. https://www.autoriteitpersoonsgegevens.nl/nl/nieuws/boete-voor-tennisbond-vanwege-verkoop-van-persoonsgegevens

    7. https://www.knltb.nl/nieuws/2020/03/knltb-in-beroep-tegen-uitspraak-ap-tennisbond-wil-sport-toegankelijk-en-betaalbaar-houden/

    The Data Lawyers

    Share article

    Comments

    MORE REACTIONS

    Leave a comment

    You must be logged in to post a comment.

    ARTICLES

    Lisa van Ginneken (D66): "Involve Personal Data Authority earlier in legislation"

    Background articles

    The mega fine for Meta, what's in it for us?

    Background articlesEXPERT

    Interview on five years of AVG: barking privacy watchdogs don't bite

    Background articlesEXPERT

    Is an app builder a data controller and is intent required for an AVG fine?

    Legal ArticlesEXPERT

    During the corona crisis, corona apps shot up like mushrooms. These corona apps allowed users to be notified when they were (potentially) in contact with...

    5 years of AVG - Data Protection Officer & Privacy Officer indispensable

    Background articlesEXPERT
    Micha Groeneveld

    AP fine for Social Insurance Bank: importance of 'risk-based' security level

    Legal Articles

    European Parliament committee not enthusiastic about new transatlantic privacy shield

    Legal ArticlesEXPERT

    Inspection of an employee's mailbox: is that allowed?

    Background articlesEXPERT

    Avg and international transfer: what does it mean for your organization?

    Legal ArticlesEXPERT
    Corine d'Hulst

    Current affairs AVG and Privacy law

    Using case law, opinions and decisions of the AP and opinions and guidelines of the EDPB, get a complete and clear picture of how further interpretation is given to the mostly open standards in the AVG and UAVG.

    Learn more

    AVG in practice for clerks

    Learn what influences the AVG will have on your work as a registrar. How do you handle personal data? And what are the obligations in the AVG for the city council?

    Learn more

    Privacy laws in detection

    You will be informed about legislation that applies to data processing by BOAs. You will learn when your BOAs must comply with the Wpg, when with the AVG and what the main differences are. You will also learn what steps need to be taken to comply with the Wpg.

    Learn more

    Data Processing and Privacy at Municipalities

    Learn more

    Privacy AVG checklist: privacy policies in 57 checklists

    View book

    Join PONT | Data & Privacy

  • Access to Knowledge Base
  • Read e-books
  • Contact with peers
  • Own news overview
    • BECOME A MEMBER

    General

    Service

    Navigate

    Berghauser Pont Media Group

    CONTACT

    𝕏

    Copyright 2025 Berghauser Pont | Website created by Buro Zero