A legitimate interest within the meaning of Article 6(1)(f) AVG does not have to arise from the law, it just does not have to be contrary to the law, the Court of Justice of the European Union (CJEU) ruled on Oct. 4, 2024. This has finally clarified the interpretation of legitimate interest at the European level. This blog details the CJEU ruling.
The Royal Dutch Lawn Tennis Association(KNLTB) is an association-style sports association. Its membership consists of affiliated tennis associations and their association members. When someone joins a tennis association affiliated with the KNLTB, that person automatically becomes a KNLTB member.
The KNLTB has shared personal data of its members with two sponsors, TennisDirect and the Dutch Lottery Organization. In particular, members' names, addresses and places of residence were shared with TennisDirect for the purpose of sending a discount flyer by mail. The KNLTB received compensation for sharing the personal data.
Following complaints, the Autoriteit Persoonsgegevens (AP) has ruled that the KNLTB acted in violation of the AVG. The KNLTB transferred personal data without the consent of its members and without a lawful basis for providing their data. The AP imposed a fine of €525,000 on the KNLTB by decision of December 20, 2019.
It is not in dispute that the KNLTB did not obtain the consent of its members to share the personal data. The KNLTB takes the position that it has a legitimate interest within the meaning of Article 6(1)(f) AVG in the processing. The legitimate interest: creating a strong bond between the KNLTB and its members, and in being able to offer added value to membership, in the form of discounts and offers with partners, allowing those members to play tennis at an affordable and accessible price. The AP believes that a purely commercial interest does not fall within the scope of the article. Only when there is an interest laid down in a law is there a legitimate interest within the meaning of the article.
The CJEU states first that any processing of personal data must be done in accordance with the principles of Article 5 AVG and satisfy the exhaustive lawfulness conditions of Article 6 AVG.[1] If the processing is not based on consent, the other justifications of Article 6(1)(b) to (f) AVG should be interpreted restrictively.
Citing settled case law[2] of the Court, the CJEU reiterates the three conditions for successful reliance on Article 6(1)(f) AVG:
The controller must pursue a legitimate interest in processing;
The processing of personal data must be necessary to pursue that legitimate interest, subject to the principles of proportionality and subsidiarity;
The interests, fundamental freedoms or fundamental rights of the data subject shall not override the legitimate interest of the controller.
The CJEU held that the legitimate interest does not have to be established by law, however, the claimed legitimate interest must be legitimate . A commercial interest of the controller may be a legitimate interest within the meaning of Article 6(1)(f) AVG to the extent that it is not contrary to law. It is up to the court to assess whether such an interest exists on a case-by-case basis, taking into account the applicable legal framework and all the circumstances of the case.
Implications for Dutch practice
The AP has taken a very restrictive position for some time now, not qualifying a purely commercial interest as a legitimate interest. Earlier, the Administrative Law Division of the Raad van State (ABRvS) already ruled in the FootballTV issue that a commercial interest (in addition to non-commercial interests) is in any case taken into account when assessing whether there is a legitimate interest. This did not involve a purely commercial interest, so that question could remain unanswered.
The CJEU's ruling does now provide a conclusive answer to the question of whether a purely commercial interest can qualify as a legitimate interest. The ruling is not a big surprise, after all, the AP was already reprimanded by the European Data Protection Board (EDPB) in 2020 for its strict interpretation of the concept of legitimate interest.[3] Now there is finally European clarity in the interpretation of legitimate interest.
The question now is whether the AP will adjust its policy and be less strict in imposing fines in the future when a commercial interest is the basis for processing personal data. In any case, the CJEU's ruling creates more clarity on the broader interpretation of legitimate interest, which may have implications for future enforcement decisions by the AP.
[1] CJEU, judgment of July 4, 2023, Meta Platforms and Others (General terms of use of an online social network), C-252/21, EU:C:2023:537, para. 90.
[2] CJEU 29 July 2019, ECLI:EU:C:2019:629(Fashion ID).
[3] Letter from the European Commission, Directorate-General for Justice and Consumer Affairs (DG JUST) dated March 6, 2020, ref. Ares (2020) 1417369.
