The Court answered questions in three privacy cases, including the KNLTB case on legitimate interest in selling personal data of members of the Royal Dutch Lawn Tennis Association. Furthermore, the Court ruled in the case of notorious privacy lawyer Max Schrems v. Meta, regarding the use of publicly known personal data for targeted ad targeting. The Court also handed down a ruling on obtaining access to personal data on a suspect's mobile device. Read a brief summary of the cases here.
The Royal Dutch Lawn Tennis Association (KNLTB) provided members' personal data to sponsors, TennisDirect and the Dutch Lottery, in exchange for payment. The members had not given permission for this. The question was whether this was justified on the basis of the KNLTB's "legitimate interest."
Law question
Can a commercial interest, such as generating revenue by selling membership data to sponsors, be considered a "legitimate interest" under the AVG even without the consent of the data subjects?
Conclusion
The Court ruled that a commercial interest can in principle qualify as a "legitimate interest" under the AVG, provided three conditions are met:
Legitimate interest: The interest must be legitimate and not contrary to law.
Necessity: The processing must be strictly necessary to achieve the interest.
Balance of interests: Members' interests and fundamental rights (privacy) should not outweigh the legitimate interest of the KNLTB.
Maximilian Schrems sued Meta Platforms Ireland for processing his personal data, including data about his sexual orientation, for targeted advertising on Facebook. Meta collected this data both inside and outside Facebook through cookies, plug-ins and pixels. The issue was whether the fact that Schrems had spoken publicly about his sexual orientation gave Meta permission to use any data collected on this subject.
Law question
May an online social network such as Facebook use all of a user's collected personal data, including sensitive data such as sexual orientation, for targeted advertising without restriction, even if the user has spoken publicly about this topic in another context?
Conclusion
The Court ruled that the principle of minimum data processing does not allow all data collected to be used for targeted advertising without restriction. While Schrems may have consented to the processing of data about his sexual orientation by speaking publicly about it, this does not give Meta the right to use all data collected on this subject.
Austrian police confiscated a person's cell phone after 85 grams of cannabis were found in his package. Police tried to unlock the phone to access the data, but failed. The person in question was unaware of these attempts until the case went to court. The question before the EU Court was whether the Austrian legislation, which allowed the police to act in this way, was compatible with EU law.
Law question
Is an attempt by police to access personal data on a cell phone, without prior permission from a judge or independent authority, consistent with EU law, even if it is a minor crime?
Conclusion
The Court concluded that relevant EU law also applies to attempts to access personal data on a cell phone, even if access fails. Access to any data on a cell phone can be a serious violation of fundamental rights. While fighting crime is important, it should not lead to unlimited access to phone data.
Key points:
Access to telephone records requires prior permission from a judge or independent authority, except in urgent cases.
The individual must be informed of the reasons for consent.
National legislation should define the factors that determine when access is justified.
