DPA approach was already overruled by Dutch lower court and criticized by the European Commission

The VoetbalTV case goes back to 2020 when the Dutch DPA issued a fine of EUR 575.000 because it viewed that VoetbalTV did not have legitimate interests for filming amateur soccer matches in cooperation with amateur soccer clubs and broadcasting the matches on the VoetbalTV platform. The Dutch DPA viewed that VoetbalTV's activities were purely for commercial interests and such interests can never be a legitimate interest.

In fact, the Dutch DPA was so convinced of their reasoning that they did not perform the three-part test following from EU case law for determining whether a legitimate interest applies. This three-part test consists of the following steps:

1. establishment of the existence of a legitimate interest behind the processing;

2. assessment regarding the necessity of the processing in question; and

3. balancing the legitimate interest of the controller with the fundamental rights and freedoms of the data subject.

The Dutch DPA stopped  its assessment at the first step by determining that no legitimate interests exist in case of pure commercial interests, without even considering steps 2 and 3. Not only was the Dutch DPA's assessment approach and decision overturned by a Dutch lower court, it was also criticized by the European Commission which urged the Dutch DPA to change its strict position.

Council of State overrules Dutch DPA decision

Convinced of its legal reasoning of its strict approach, the Dutch DPA decided to appeal the lower court decision to the Council of State, the highest Dutch general administrative court. Fortunately, the Council of State agreed with the lower court and confirmed that the Dutch DPA's decision was inadequately substantiated by:

1. not considering other non-commercial interests which were presented by VoetbalTV or the interest of other parties (e.g. increasing the involvement and enjoyment of soccer fans and soccer players, being able to perform technical analysis for/by trainers or analysts, being able to offer soccer players and their family and friends the opportunity to watch matches remotely); and

2. not performing the three-part assessment as required to adequately assess whether a legitimate interest exists that is necessary and proportionate, and outweighs the rights and freedoms of the data subjects.

As a result, the Council of State overturned the Dutch DPA's decision. What is unfortunate, however, is that the Council of State determined that because the Dutch DPA did not take into account other non-commercial interests of VoetbalTV and others in its assessment, it was unnecessary to assess whether purely commercial interests can qualify as a legitimate interest and/or ask preliminary questions to the EU Court of Justice for clarification.

What's next

The legal uncertainty in the Netherlands is far from over. Now that the Council of State has not used this opportunity to provide much needed clarity and the Dutch DPA is not persuaded by the European Commission's call for change, it is likely that the Dutch DPA will continue with enforcing their strict approach. It is even being suggested that the Dutch DPA is actively lobbying within the EDPB for including their strict approach in upcoming EDPB guidance on legitimate interests. Such a strict approach would have great and potentially destructive effects on businesses active in the EU. Hopefully, the EDPB or the EU Court of Justice will give clear guidance sooner than later that purely commercial interests may not be categorically excluded as legitimate interests.

Authored by Chantal van Dam and Joke Bodewits.