The RVS confirmed the lower court’s annulment of the fine imposed by the Dutch Data Protection Authority, but unfortunately did not address the question of whether purely commercial interests alone can be considered a valid legitimate interest.
Data processing by VoetbalTV, a collaboration between the Royal Netherlands Football Association and Talpa Network, which enabled fans to view professional video footage of amateur football matches on VoetbalTV’s online platform, was based on legitimate interest. The Dutch Data Protection Authority investigated Voetbal TV and fined it €575,000 in 2019. In the enforcement action against VoetbalTV, the Dutch DPA took the position that a legitimate interest under the GDPR should constitute an interest designated as a legal interest in the legislation or otherwise by law and it should be considered “worthy of protection” and a “ have an “urgent” character.
According to the Dutch Data Protection Authority, purely commercial interests and profit maximization are not specific enough and do not have an overriding “legal” character and therefore cannot be qualified as legitimate interests. Therefore, VoetbalTV has violated the GDPR by processing personal data without a valid legal basis.
VoetbalTV argued that its interest in processing is to (i) increase the involvement and enjoyment of football fans, including the players captured in the video, (ii) enable technical analysis by football club coaches and analysts and third parties, and (iii) Allow gamers, friends and family members to watch games remotely. These arguments were rejected by the Dutch Data Protection Authority and a fine was imposed. VoetbalTV has challenged the decision of the Dutch Data Protection Authority in court.
In November 2020, the Midden-Nederland District Court contradicted the Dutch Data Protection Authority, ruling that the Dutch Data Protection Authority had failed to properly assess whether VoetbalTV had adequately applied the legitimate interest ground due to its rigid interpretation, and annulled the Dutch Data Protection Authority’s decision to impose the fine. The decision is available here (in Dutch).
The Dutch Data Protection Authority appealed the court decision to the RVS. Among other things, the Dutch Data Protection Authority asked the RVS to submit the question of whether purely commercial interests of the controller can be considered a legitimate interest under Article 6(1)(f) GDPR.
The RVS upheld the lower court’s decision and ruled that VoetbalTV did not have to pay the fine as the decision of the Dutch Data Protection Authority was unfounded. The RVS ruled that the Dutch Data Protection Authority wrongly failed to check whether the processing of VoetbalTV (the filming of football matches and making it available to third parties, including people who wanted to be filmed) was also necessary for the fulfillment of interests other than the purely commercial interests of VoetbalTV is required. The RVS also pointed out that it is up to the controller to determine what interest it has in the processing, why that processing is necessary to carry it out and to act accordingly. For its part, the Dutch Data Protection Authority should assess what the controller is actually doing, whether the intended interests are fulfilled by this activity and whether the processing is justified. The RVS confirmed the lower court’s reasoning that the Dutch data protection authority should have taken these aspects and other non-commercial interests into account.
By wrongly disregarding the interests claimed by VoetbalTV, the Dutch Data Protection Authority wrongly found that VoetbalTV had breached Article 6(1)(f) GDPR. The RVS further came to the conclusion that it was not necessary to answer the question of whether an exclusively commercial interest in itself can be a legitimate interest within the meaning of Art. 6 (1) lit to submit.
Controversial Guidance on Legitimate Interests from the Dutch Data Protection Authority
In November 2019, the Dutch Data Protection Authority also published guidance on the interpretation of legitimate interest (Normuitleg Groundslag ‘just value’, available here in Dutch), rejecting purely commercial interests and profit maximization of a controller as legitimate interests within the meaning of Article 6(1)(f) GDPR. The guidelines stated that there is no legitimate interest when personal data is used for (i) purely commercial interests, (ii) profit maximization, (iii) monitoring employee behavior without a legitimate reason, or (iv) tracking customer behavior (purchasing or otherwise). or potential customers.
In June 2022, Dutch and international mass media published leaked versions of the 2020 correspondence between the European Commission and the Dutch Data Protection Authority, in which the European Commission criticized the Dutch Data Protection Authority’s stance on the matter. The EDPB has been working on updating the pre-GDPR guidance on the notion of legitimate interest, which aims to clarify the common position of EU supervisors on this issue.
You can find the RVS press release here and the decision here (both in Dutch only).