CJEU clears the air, Dutch DPA’s interpretation of legitimate interests is too strict

Background

The judgement of 4 October stems from preliminary questions referred to the CJEU in September 2022. Back then, following the appeal of the Dutch DPA’s controversial Royal Dutch Tennis Association (KNLTB) fine decision, the Dutch District Court of Amsterdam referred questions for preliminary ruling regarding the interpretation of the term “legitimate interest” under Article 6(1)(f) GDPR.

In its original fine decision, the Dutch DPA considered the KNLTB could not rely on the legitimate interest ground to share members’ personal data with sponsors, as the KNLTB’s purpose was purely commercial. However, as we have explored in previous blogs, the Dutch DPA has caused significant controversy by insisting that purely commercial interests cannot qualify as legitimate interests. Two weeks ago, we already anticipated on this CJEU judgement following the suspension of a Dutch DPA fine decision in the same context. Now, the CJEU has finally clarified that commercial interests may, in fact, qualify as legitimate interests dependent on the specific circumstances of a case.

What does this CJEU judgement tell us?

As we anticipated, the CJEU underlines Recital 47 GDPR, which confirms that a legitimate interest does not need to be established in law, and that, in general, direct marketing purposes may qualify as legitimate interests. Moreover, the CJEU reverts to previous case law, including CJEU SCHUFA Holding and CJEU Meta Platforms, by stating that a wide range of interests is, in principle, capable of being regarded as legitimate and that the legitimate interest test consists of three cumulative criteria, namely: i) the interests pursued are “legitimate”, ii) the processing of personal data concerned is necessary for the legitimate interests pursued, and iii) fundamental rights and freedoms of the data subject do not take precedence.

Whereas the Dutch DPA holds the position that purely commercial interests fail to meet the first requirement of being “legitimate”, the CJEU, by reference to CJEU Google Spain, reiterates that it has not ruled out the possibility that a controller’s commercial interest, such as promoting and selling advertising space for marketing purposes, can qualify as a legitimate interest under Article 6(1)(f) GDPR. If the other two criteria are also fulfilled, commercial purposes can thus pass the legitimate interest test. 

The CJEU emphasizes the equal importance of the last two criteria and takes the opportunity to provide guidance to the referring court, thereby providing more detailed explanation on the application of Article 6(1)(f) GDPR. Whilst the CJEU seems to question the true necessity of the KNLTB data processing activities concerned, for the KNLTB it remains to be seen how the Dutch District Court will ultimately rule on the matter.

Although the CJEU reminds that, as a general rule, the legal bases of Article 6 GDPR must be interpreted restrictively, it regards the viewpoint of the Dutch DPA as too restrictive. Commercial interests may not be categorically excluded from the legitimate interest ground, insofar as they are not contrary to the law.

More legal certainty

This ruling of the CJEU is not surprising. The conclusion that legitimate interests should not be “illegitimate” is not groundbreaking either. What is a relevant development, however, is that it has now been confirmed by the highest court that purely commercial interests may qualify as legitimate interests and, therefore, that the Dutch DPA’s interpretation is too strict. There is now a CJEU judgement - that is a direct result of questions raised about the Dutch DPA’s strict interpretation – which the Dutch DPA cannot ignore. It will be interesting to see how the Dutch DPA will react, particularly since the Dutch DPA has previously disregarded the European Commission’s criticisms on the matter.

Businesses throughout Europe will appreciate the legal certainty brought by this judgement, as it enhances their options for processing personal data for commercial interests. We regard this as a positive and logical development. After all, the aim of the GDPR is not to hinder the conduct of business in the EU, but to allow the conduct of business while ensuring a high level of data protection. Nevertheless, businesses should keep in mind that, in order to rely on Article 6(1)(f) GDPR, data processing must also be strictly necessary and balanced against the fundamental interests and rights of data subjects.