The European Commission believes that the Personal Data Authority (AP) is interpreting the General Data Protection Regulation (AVG) too strictly. This risks hampering free enterprise in the EU. The EU executive is asking the regulator to apply European privacy laws less strictly. This is according to a letter from the European Commission that was accessed by NRC.
Specifically, it concerns the position that commercial interests can never qualify as a legitimate interest. In 2020, the Personal Data Authority handed out two sky-high fines for this reason. For example, the Royal Dutch Lawn Tennis Association (KNLTB) was fined €525,000 because it sold email addresses and other personal data of members to sponsors for direct marketing.
The tennis association disagreed and defended itself by saying that it was a legitimate interest. By selling member data to third parties, the association would strengthen its economic position. Were it not to do so, tennis would become a lot more expensive. "The tennis association has always handled members' personal data with care and has been open and transparent about its policy on sharing personal data," the KNLTB said.
The AP upheld the fine because, in its view, a commercial interest could never be a legitimate interest.
FootballTV also got into trouble with the Personal Data Authority. The platform broadcast live matches in amateur soccer. Smart cameras were used to capture the matches properly. Members had to pay for this streaming service.
However, the regulator found that there was a gross violation of privacy. The soccer platform was therefore fined 575,000 euros. FootballTV defended itself by saying there was a legitimate interest. As with the KNLTB, the Personal Data Authority wanted nothing to do with this: a commercial interest can never be qualified as a legitimate interest, was the ruling.
FootballTV did not accept this and appealed the fine. The Utrecht court rejected the regulator's fine. "Because the defendant did not fully investigate the processing of personal data and stopped at the determination that the plaintiff does not have a legitimate interest, the decision was otherwise not taken with sufficient care and is therefore in violation of Article 3:2 of the General Administrative Law Act (Awb). The imposition of the fine cannot therefore stand," the judge ruled.
The State Council will issue a ruling on the matter soon.
The issues were widely written about not only in the Netherlands. The news reached the European Commission. It was forced to get involved. The EU executive board sent a letter to AP board chairman Aleid Wolfsen. In this letter -owned by NRC- the Commission warned that the Dutch regulator's strict interpretation of the AVG endangers the internal market and hinders free enterprise.
Brussels points out that commercial considerations can indeed be a legitimate interest. European judges have ruled that Google may collect personal data of Internet users from commercial considerations. The European Commission invites Wolfsen to change his position.
In a response -also in the hands of NRC- the board chairman points out that the regulator holds an independent position. He denies that his interpretation of legitimate interest contradicts the rulings of the European Court of Justice in Luxembourg. Wolfsen acknowledges that the AVG must be interpreted in the same way throughout Europe. However, it is up to national regulators to agree on this. The European Data Protection Board (EDPB), the umbrella organization of all European regulators, is said to be busy doing so.
Former employees of the Personal Data Authority tell NRC that Wolfsen is pushing his position on the incompatibility of commercial interest and legitimate interest. In this way, he would want to protect consumers from the data hunger of commercial companies. Internal lawyers allegedly warned the board chairman that judges might disagree with his interpretation.
