On the 4th of October of this year, the Court of Justice of the European Union (CJEU) passed a judgment on case C 621/22, in answer to a preliminary ruling raised by the Court of the First Instance of Amsterdam, in relation to the interpretation of article 6 of the General Data Protection Regulation (GDPR).
The petition was filed in the context of litigation proceedings between the Royal Dutch Lawn Tennis Association (KNLTB) and the Dutch Data Protection Authority (DPA).
In 2018, the KNLTB sent personal data of its members to two companies who were sponsors of the federation. The first company sold sports equipment; the second was the country’s largest provider of gambling services and casinos.
The personal data, which were sent for the purpose of carrying out a telephone campaign, included, besides names, contact details and addresses of its members, their dates of birth, landline numbers, mobile numbers, and e-mail addresses, as well as the names of the tennis clubs of which they were members.
As a result of numerous claims filed by members of the KNLTB, the DPA imposed a 525,000 Euro fine on the federation. The KNLTB formally appealed against this sanction before the Court of the First Instance in Amsterdam, alleging that the sending of these personal data was based on a legitimate interest, as a result of which the federation was permitted to form connections with its members, as well as to offer them advantages in the form of offers.
In order to correctly interpret the concept of “legitimate interests”, as defined in article 6, clause 1, first paragraph, subsection (f) of the GDPR, the Court of the First Instance in Amsterdam suspended proceedings and referred the following enquiries to the CJEU:
- How should [the Court of the First Instance] interpret the concept of “legitimate interest” [as defined in article 6, clause 1, first paragraph, subsection (f) of the GDPR]?
- Is the interpretation of the KNLTB correct? Are we dealing exclusively with interests which are recognised in law, which are law, and/or which are defined by law?
- Is any interest legitimate unless it is unlawful? Or more specifically: can it be the case that, in certain circumstances, a purely commercial interest, including the interest which is at issue in this present matter, – namely, the delivery in exchange for payment of personal data without the consent of the data subject – may constitute a legitimate interest? If so, which circumstances determine whether a purely commercial interest constitutes a legitimate interest?
In response to the questions referred for a preliminary ruling, the CJEU declared as follows:
With regard to the correct interpretation of legitimate interest, the CJEU indicated that the concept is a broad one, and not limited to interests defined in law. Rather, the concept may include commercial interests, so long as they always comply with requirements of legality, transparency and loyalty.
With regard to the principle of necessity and minimisation of data, the CJEU concluded that it must be verified that the “legitimate interest” in processing the data may not be achieved in an equally effective manner via other less injurious methods, with respect to the fundamental rights and freedoms of persons, and with particular emphasis on the right to privacy and the protection of personal data. Likewise, the CJEU reinforced the importance of informing data subjects and, thereby, endowing them with control over the utilisation of their personal data.
In answer to the issue of which interests may be considered legitimate, the reasonable expectations of the data subject must be accounted for, as well as the scope and impact of the processing of their personal data. It is essential to evaluate if the members of the tennis federation might reasonably expect their data to be shared with sponsors for advertising purposes.
The CJEU concluded by declaring that legitimate interests do not automatically serve as a basis for the processing of personal data without the consent of the data subjects, and that, in any event, a case-sensitive analysis is required. Likewise, the CJEU affirmed that the right to data protection must not be sacrificed for the sake of economic interests which are not strictly necessary or proportionate.
Oscar Vilá
Vilá Abogados
For more information please contact:
31st of October 2024
