The EU Commission has expressed concerns about the Dutch data protection authority’s strict interpretation of “legitimate interests”, considering it to be “not in line with the GDPR, the guidelines of the Article 29 Working Party/EDPB and the case law of the European Court of Justice (CJEU)”. Those concerns focus on guidance issued by the Autoriteit Persoonsgegevens (“AP”) in 2019, stating that purely commercial purposes, such as maximization of profits, would not be considered a “legitimate interest”. Now, in addition to the EU Commission’s expression of concern, the Netherlands’ highest administrative court (the Council of State) is preparing to decide on the AP’s appeal in VoetbalTV. At stake is the consistent interpretation and enforcement of GDPR across EU member states. As the EU Commission pointed out: it is of outmost importance that the national guidelines are in line with the case law of the CJEU and with the guidelines adopted on the European Data Protection Board (EDPB) level.

Some background

VoetbalTV is a social and video platform for amateur football. It makes video recordings of matches in amateur football on behalf of football clubs and allows its members to interact and share information through an app. The AP found, on 16 July 2020, that VoetbalTV’s video recordings and their subsequent distribution and processing by analytics tools via this app (activities carried out without the consent of the data subjects, many of them minors) was in breach of Article 6 (1) of the GDPR and sanctioned VoetbalTV with a €575,000 GDPR fine.

The AP concluded that commercial interests cannot be regarded as lawful legitimate interests as they lack urgent “legal” character. Consequently, processing was unlawful rather than being subject to an assessment on the need and proportionality of the processing.

The Central Netherlands District Court overturned the AP’s decision on the basis that the a priori exclusion of certain legitimate interests has been “specifically prohibited” by the CJEU in repeated case law (a ruling that has been appealed by the AP and on which the Council of State will be deciding in the coming months).

Deeper into the AP’s stance

According to the Central Netherlands District Court’s decision, the AP’s position is that “a legitimate interest is an interest that is designated as a legal interest in (general) legislation or elsewhere in the law. It must therefore be an interest that is also protected in law, that is considered worthy of protection and that in principle must be respected and can be ‘enforced’. For an interest to qualify as a legitimate interest, this interest must have a more or less urgent and specific character that follows from a (written or unwritten) legal rule or principle; it must in a certain sense be unavoidable that these legitimate interests are served. Purely commercial interests and the interest of profit maximization are not specific enough and lack an urgent ‘legal’ character, so that they cannot be regarded as legitimate interests.”

Some views on the legal concern

A move away from the AP’s restrictive view of legitimate interests would not necessarily change the outcome for VoetbalTV on the particular facts of their case. Even if purely commercial factors such as profit maximization were to be recognised as potentially legitimate interests, VoetbalTV’s interests might not be considered sufficiently compelling to override the rights and freedoms of data subjects. However, the broader implications of such a change would be significant for other organisations as it would mean that commercial interests could, subject to passing the balancing test, be established as a legitimate interest rather than being ruled out as a blanket matter by the AP’s current approach. As the EU Commission pointed out:

it  also  has  to  be  borne  in  mind  that  the  freedom  to  conduct  a  business, including  pursuing  pure  commercial  interests  such  as  profit  maximisation,  is  a  human right  enshrined  in  Article 16  of  the  Charter  of  Fundamental  Rights  of  the  European Union  (EU  Charter).  Recital 4  of  the  GDPR  underlines  that  the  right  to  protection  of personal data is not an absolute right and it has to be balanced against other fundamental rights, such as the freedom to conduct a business. The strict interpretation of the Dutch DPA does not allow an appropriate balance to be struck between the rights at issue, as the right to data protection is given precedence by virtue of the fact that certain interests rooted in the freedom to conduct a business are categorically considered illegitimate.

It is worth noting that the AP is not alone in its stance. The Portuguese data protection authorities (CNPD) have also proven to be very rigid in respect of the scope of the processing activities that can be carried out on the basis of legitimate interests, endorsing only those specifically recognized in the law.

We look forward to the ultimate decision of the Council of State and, in particular, whether their views coincide with those of the AP or with the European Commission’s statement that: there is nothing in the jurisprudence of the CJEU which allows one to conclude that the CJEU is of the opinion that economic interests cannot be considered legitimate under Article 6(1)(f) GDPR.