ECJ rules on commercial interests as legitimate interest

The European Court of Justice (ECJ) issued a preliminary ruling on 4 October 2024 following questions posed by the District Court of Amsterdam in a dispute between the Royal Dutch Lawn Tennis Association (the KNLTB) and the Dutch Data Protection Authority (the Dutch DPA).

The full judgment can be found here: ECJ Judgment of October 4, 2024 (C-621/22).

Key Takeaway

The most important element of this ruling is the clear confirmation by the ECJ that:

• an interest need not be enshrined in EU or local law in order to qualify as a legitimate interest for the processing of personal data as meant in Article 6(1)(f) of the GDPR, and

• purely commercial interests, such as selling personal data for direct marketing purposes, can in principle also constitute such a legitimate interest and constitute a valid legal basis for data processing activities.

Background

In 2019, the Dutch DPA imposed a fine of EUR 525,000 on the KNLTB for infringing the GDPR by selling certain personal data of its members, without their consent, to two of its sponsors for promotional and marketing purposes, namely SportshopsDirect (TennisDirect), a company selling sports products, and the Dutch Lottery Organisation (the NLO), a provider of lottery and casino games in the Netherlands.

The Dutch DPA argued that the KNLTB's sale of data to sponsors, which the KNLTB claimed was based on a legitimate interest under Article 6(1)(f) of the GDPR, did not meet the required criteria. According to the DPA, only interests that are specifically recognised and protected by EU or national law qualify as legitimate, as only these interests are considered worthy of protection under EU or national law. According to the Dutch DPA, KNLTB's commercial objectives did not constitute a legally recognised interest and, therefore, cannot justify the processing of the relevant personal data.

The ruling of the ECJ

In its ruling, the ECJ recalls that in order for the processing of personal data to be lawful under Article 6(1)(f) of the GDPR, three cumulative conditions must be met:

1. Legitimate interest: The processing must serve a legitimate interest of the controller (in this case the KNLTB) or a third party. The ECJ emphasises that a wide range of interests can qualify as legitimate and that the concept of "legitimate interest" is not limited to interests enshrined in and determined by law, although the concept does require the interest pursued to be lawful. The ECJ also points out that the controller is held under Article 13(1)(d) GDPR to inform a data subject of the legitimate interest concerned at the time the personal data is collected.

• The ECJ held that KNLTB's commercial interest can indeed constitute a legitimate interest.

2. Necessity: The processing must be necessary for the purposes of the legitimate interests pursued (as also required by the data minimisation principle in Article 5(1)(c) GDPR). It should assessed whether these purposes can reasonably be achieved as effectively by other means that are less restrictive of privacy rights.

• The ECJ pointed out that it should be possible for the KNLTB to inform its members beforehand and ask them whether they agree to the sharing of their data with third parties for advertising or marketing purposes, and that the local court should ascertain whether this less intrusive approach would indeed allow the KNLTB to pursue its legitimate interest in an equally efficient manner.

3. Rights of data subjects: The legitimate interests pursued should not be overridden by the interests or rights of data subjects. The ECJ emphasises the need for a careful balance between these conflicting rights and interests, which largely depends on the specific situation. In this context, it is also important to consider if the data subjects could reasonably anticipate the processing of their personal data in a given context.

• The ECJ tasked the local Dutch court with balancing the respective rights and interests. The ECJ also remarked that the promotional and marketing activities conducted by the NLO as a lottery and casino games company do not appear to have a relevant or appropriate connection with the KNLTB and its members. The ECJ thereby suggested that, differently perhaps from the sale of the personal data to TennisDirect, the KNLTB members might not have reasonably expected their personal data to be sold to an organization like the NLO.

Conclusion

With this ruling, the ECJ has hopefully put an end to the discussion instigated by the Dutch DPA whether purely commercial interests can qualify as a legitimate interest for the processing of personal data. They can, and one might rightfully ask why the Dutch DPA ever thought differently. Recital 47 of the GDPR expressly cites direct marketing as an example of a legitimate interest. Moreover, the guidance from the Article 29 Working Party (the European Data Protection Board’s predecessor) accepted the economic interests of a company as possible legitimate interests, the European Commission proactively sent the Dutch DPA a letter objecting to its narrow interpretation of legitimate interests, and prior ECJ case law also pointed towards the acceptance of purely commercial interests as potentially legitimate interests.

The possibility of qualifying purely commercial interests as a legitimate interest does not mean that all control is lost over the commercial exploitation of personal data. The other two conditions to invoke Article 6(1)(f) GDPR mentioned in the above must also be met, and the GDPR contains further provisions protecting data subjects, such as the obligation for controllers to inform data subjects of the fact that their personal data may be used for commercial purposes (Article 13 and 14 GDPR) and a right of data subjects to object against such processing (Article 21 GDPR).

All these conditions are more fully described in new guidance issued for public consultation by the European Data Protection Board on 8 October 2024, shortly after the ECJ ruling, on the processing of personal data on the basis of legitimate interests: Guidelines on processing of personal data based on Article 6(1)(f) GDPR.