The Dutch supervisory authority (Dutch DPA) has long taken the position that a purely commercial interest cannot be a legitimate interest as referred to in Article 6(1)(f) of the GDPR. On that basis the Dutch DPA imposed a € 575,000 fine on VoetbalTV in 2020. A Dutch lower administrative court disapproved of the strict interpretation of legitimate interests by the Dutch DPA and annulled the fine.
The Dutch DPA has investigated the privacy of players and spectators filmed by VoetbalTV. VoetbalTV is an online platform that broadcasts amateur football. Users were able to watch highlights, share those highlights or use the clips as preparation for their matches. In September 2020 VoetbalTV was declared bankrupt. The Dutch DPA concluded that VoetbalTV should not have broadcast the film footage of the footballers, because there is no lawful basis for the recording and distribution of this footage. The Dutch DPA imposed a fine of € 575,000 on VoetbalTV for unlawful processing of personal data. VoetbalTV did not agree with the fine and initiated court proceedings against the Dutch DPA. A Dutch lower administrative court gave judgment on 23 November 2020.
VoetbalTV believes it has a legitimate commercial interest in distributing the images The court ruled that a purely commercial interest can be a legitimate interest for processing personal data (Art. 6 (1) f AVG) and thus for making recordings and distributing the images. This follows from European case law.
Dutch DPA: a commercial interest can never amount to a legitimate interest
In determining what constitutes a legitimate interest, the Dutch DPA applies a strict view: an interest is only legitimate if it is named as a “legal interest” in law or unwritten law. This interest must be of a more or less urgent and specific nature arising from a rule or principle of law. If this is not the case then there is no legitimate interest that has to be taken into account in the balancing test. Purely commercial interests and profit maximization lack a legal character. Therefore, according to the Dutch DPA, those interests can never amount to a legitimate interest. This restrictive interpretation is also found in the guidance note the Dutch DPA has published on how legitimate interests under the GDPR should be interpreted. Dutch legal practitioners have been critical of the guidance note from the Dutch DPA.
According to Voetbal TV, the level playing field is much broader: any interest can be legitimate as long as it is not contradictory to statutory law.
The European Perspective
The ‘Fashion ID’ judgment from the Court of Justice of the European Union (CJEU) (ECLI:EU:C:2019:629) shows that the legitimate interest is entirely flexible and open-ended in nature. Fashion ID collected and shared personal data in order to benefit from the commercial advantage consisting in increased publicity for its goods. This too can amount to a legitimate interest. Indeed, recital 47 to the GDPR stipulates that direct marketing can be a legitimate interest. By excluding purely commercial interests, commercial enterprises never get around to the balancing test for which the ‘legitimate interest’ basis was created. Both the right to respect for one’s private life and the freedom of enterprise are European fundamental rights. Fundamental rights must be taken into a balancing test for which the ‘legitimate interest’ basis was created. The one fundamental right never prevails over the other by definition. Any interest can be legitimate. The European Data Protection Board (EDPB) also defined legitimate interests in a more inclusive manner.
This interpretation allows for more interests being legitimate than the Dutch DPA’s interpretation, as many factual, economic, and idealistic interests are not designated in the law. The court rules that it is – in principle – up to controllers (i.e., VoetbalTV) to determine their legitimate interests. The controller must act accordingly.
Judge overturns Dutch DPA GDPR fine
In the Voetbal TV case, the court adopts the broad interpretation of “legitimate interest” used by the CJEU in the Fashion ID case: is the processor not pursuing an interest that is contrary to the law ?
The court disapproved the strict interpretation of legitimate interests by the Dutch DPA. According to the court, excluding certain interests in advance is contrary to European law.
Moreover VoetbalTV indicates that it has interests that go beyond commercial purposes. Distributing the images is also informative and makes the sport available to a wider audience.
Based on the purposes stated by VoetbalTV and the explanation that the processing is necessary and proportionate, the Dutch DPA must still assess whether VoetbalTV has a legitimate interest in recording and broadcasting the film footage of footballers.
What are the consequences of this judgment?
The Dutch DPA will have to revise its guidance note on how legitimate interests under the GDPR should be interpreted. The VoetbalTV judgment enables organisations to process personal data on the basis of commercial interests since these are legitimate interests in the meaning of article 6(1)(f) GDPR. In that case, it is not necessary to ask all data subjects involved if they are willing to consent to the data processing. This is good news for (commercial) organisations. However, it is important to note they must have a well-founded explanation for the (intended) data processing.
The period for submitting an appeal with the Court of Appeal has now expired. It is not known to us whether an appeal has been submitted, but we do not consider that there is a very high risk of the Court of Appeal adopting a different course. Interesting from an EU perspective is that on September 2, 2020, the European Data Protection Board (EDPB) published draft guidelines on the targeting of social media users on its website. The EDPB maintains the position that commercial interests can also amount to a legitimate interest. It will be interesting to see how the Dutch DPA’s legitimate interest interpretation in the Netherlands and on EU level is impacted at this stage.
Our Privacy Desk will of course keep you updated regarding ongoing developments.
