Netherlands Update: Can a purely commercial interest be a ‘legitimate interest’ within the meaning of the GDPR?

The ‘legitimate interest’ is one of the bases exhaustively listed in Article 6 of the General Data Protection Regulation (“GDPR”), on the basis of which the processing of personal data may be lawful. The scope of the ‘legitimate interest’ has been under discussion in the Netherlands for some time.

The Dutch Data Protection Authority (“AP”) believes that a ‘legitimate interest’ can only arise from the law, and that a purely commercial interest can never be a ‘legitimate interest’. This follows, among other things, from the ‘Standard interpretation basis for legitimate interest’, which has been drawn up by the DPA. For example, it says:

“What also does not qualify as a legitimate interest is, for example: only serving purely commercial interests, maximizing profits, following the behavior of employees or the (buying) behavior of (potential) customers without legitimate interest, etc.”

The question is whether the concept of ‘legitimate interest’ should not be interpreted more broadly than the DPA does. In particular, in view of recital 47 of the GDPR, which states that direct marketing can also be a legitimate interest, that interpretation does not appear to be in accordance with the GDPR.

It was expected to gain clarity on this point by the ruling in the case between VoetbalTV and the AP. The video platform VoetbalTV, commissioned by football clubs, made video recordings of matches in amateur football. The AP imposed a fine of € 575,000 on VoetbalTV in 2020, because according to the AP VoetbalTV would have no basis for processing the personal data. In that case, the DPA was of the opinion that VoetbalTV in any case had no legitimate interest in the processing of the personal data, because its interest was purely commercial in nature. According to VoetbalTV, however, any interest could be a ‘legitimate interest’, as long as this is not contrary to the law. On 27 July 2022, the Administrative Jurisdiction Division of the Council of State ruled in the much-discussed dispute, and ruled that VoetbalTV could also base the processing on interests other than a purely commercial interest. VoetbalTV was right about this, but to the disappointment of many lawyers it remained unclear whether a purely commercial interest can constitute a legitimate interest.

New round, new opportunities

Nevertheless, we can expect clarity soon.

In a dispute before the District Court of Amsterdam, the DPA again takes the position that a purely commercial interest cannot be a legitimate interest. To this end, it states, among other things, that a grammatical interpretation of the GDPR entails that there must be a legitimate and therefore concrete ‘belonging to the law, being law, laid down in law’ interest, in order to be able to speak of a legitimate interest. In that context, the DPA refers to (part of) recital 47 of the GDPR, which states: “Such a legitimate interest may be present, for example, when there is a relevant and appropriate relationship between the data subject and the controller, in situations where the data subject is a customer or is employed by the controller”. It reads this in such a way that it is meant that the processing of personal data of persons who should not reasonably expect this cannot be based on legitimate interest.

It follows from consideration 3.2 of the judgment of the District Court of Amsterdam that, according to the DPA, it must therefore be a pre-established interest of the controller that the data subject can take into account in order to speak of a legitimate interest. An interest that is not a legitimate interest and therefore not an ‘interest belonging to the law, being law, laid down in the law’ is not sufficiently known in advance with the result that this cannot be a legitimate interest. A ‘positive test’. Moreover, according to the AP, this explanation is the explanation that best fits the system of the GDPR and the European fundamental rights.

According to the plaintiff in the dispute, the sports association KNLTB to which the DPA has imposed a fine of € 525,000 for providing personal data for promotional actions to two sponsors, this explanation is not in accordance with the legal text. In that context, it refers to recital 47 of the GDPR, in which ‘direct marketing’ is regarded as a legitimate interest. The KNLTB is of the opinion that any interest can be a legitimate interest, unless that interest is contrary to the law. According to the KNLTB, a negative test therefore applies to the determination of a legitimate interest.

The court considers that the question whether the KNLTB has a legitimate interest in the processing of personal data of its members cannot be answered without reasonable doubt and therefore referred questions to the Court of Justice for a preliminary ruling on this subject on 22 September 2022.

I think there’s a good chance the AP will be proven wrong. In fact, another outcome would surprise me. On 6 March 2020, the European Commission has already reprimanded the DPA and indicated that this strict interpretation of the legitimate interest is not in accordance with the GDPR, the guidelines of the Data Protection Working Party Article 29/EDPB and the case law of the Court of Justice of the European Union. According to the European Commission, this interpretation has the effect of not striking an appropriate balance between the rights in question, since the right to data protection thus takes precedence over the right to freedom to conduct a business, by structurally classifying the latter right as an unjustified interest.

Whether KNLTB benefits from this outcome is a second. Because even if the commercial interest is a legitimate interest, the next question is whether knltb’s commercial interest outweighs the interest of the parties involved. This seems unlikely to me, since KNLTB has provided member data to sponsors without permission to generate income and this – also according to the AP – was not in line with the expectations of those involved. Furthermore, the DPA’s Decision on fines gives no reason to assume that the processing could be lawful on another basis. That is why KNLTB will most likely end up losing out.

In any case, the fundamental discussion about the legitimate interest will come to an end next year. Of course, we will keep you informed.

By Hocker, Netherlands, a Transatlantic Law International Affiliated Firm. 

For further information or for any assistance please contact netherlands@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom.