On Friday 4 October, the Court of Justice of the European Union (CJEU), the highest judicial authority in the EU, delivered its judgment in the case C-621/22 Koninklijke Nederlandse Lawn Tennisbond (KNLT). The Court ruled against the Dutch Data Protection Authority – the Autoriteit Persoonsgegevens (“the AP”) – for being too strict in its interpretation of legitimate interests and clarified that purely commercial interests can qualify as legitimate interests.
The original case dates to 2020 when KNLT contested the €525,000 fine levied by the AP in 2019 for contravening Art 6 (1)(f) GDPR following complaints from KNLT members over the disclosure of their personal data with sponsors. The AP argued that KNLT could not rely on ‘legitimate interest’ as a legal basis for sharing its members’ data for promotional use and that a commercial interest was incapable of qualifying as a legitimate interest.
In appealing to the Amsterdam District Court, KNLT argued that the disclosure of member data was consistent with the meaning of legitimate interests under GDPR given that 1) the interest first consisted of a strong link between the association and its members; and 2) it provided the ability to provide value to its members in the form of discounts and offers from partners and enabling those members to play tennis at an affordable price.
The AP believed that to qualify for legitimate interests under the GDPR, the interest must be enshrined in and determined by law. In other words, it must be an interest that is deemed worthy of protecting under EU or national law.
In referring the matter to the CJEU, the Amsterdam District court asked the following questions:
- How should the District Court interpret the term ‘legitimate interest’ within GPDR Art 6(f)?
- Should the term be interpreted according to the Dutch DPA interpretation? Are these interests which exclusively pertain to the law, constitute law, are enshrined in law? Or;
- Can any interest be a legitimate interest, provided that interest is not in breach of the law? More specifically, should a purely commercial interest, such as the interest at issue here, the provision of personal data in return for payment without the consent of the data subject concerned, be regarded as a legitimate interest under certain circumstances? If so, what circumstances determine whether a purely commercial interest is a legitimate interest?
Crucially, the CJEU emphasised that relying on legitimate interests to process personal data is lawful ‘except where such interests are overridden by the interests or fundamental rights of the data subject’.
Additionally, the CJEU recalled the three cumulative conditions which controllers must meet in order to lawfully process personal data on the basis of legitimate interest (“the legitimate interest balancing test”). Firstly, the pursuit of a legitimate interest by the data controller. Secondly, the need to process personal data for the purposes of the legitimate interests pursued. Thirdly, the interests or fundamental freedoms and rights of the person concerned did not override the legitimate interest of the controller.
As to what constituted a ‘legitimate interest’, the CJEU stated that the EU legislature did not require that the interest pursued by a controller be provided for by law. This was consistent with the CJEU judgment in SCHUFA Holding that ‘a wide range of interests is, in principle, capable of being regarded as legitimate’ (paragraph 76). Furthermore, the CJEU said that whilst ‘legitimate interests’ was not limited to interests which are enshrined in and determined by law, they needed to be lawful.
Importantly the CJEU’s recalled Recital 47 of the GDPR and confirmed that the promotion of and sale of advertising space for marketing purposes may be regarded as a legitimate interest.
The Court’s judgment will now be used by the Amsterdam’s appeal court for a definitive ruling. We think that this judgement will bring legal certainty around the use of legitimate interests and will increase data controllers’ options for processing personal data for commercial purposes.