Is a commercial interest a legitimate interest?

The processing of personal data requires a legal basis, as mentioned in Article 6 of the General Data Protection Regulation (GDPR). Such a basis exists, for example, when consent is obtained for the processing of personal data, but also when the processing is "necessary for the protection of the legitimate interests" of the initiator of the processing (the data controller).

A legitimate interest of the controller can be anything. For example, one might think of sending e-mail newsletters but also of securing property. Not infrequently a company wishes to invoke a legitimate interest, in the context of its commercial activities. Such is the case with VoetbalTV and the KNLTB. The Dutch data protection authority, the Autoriteit Persoonsgegevens (AP) has imposed hefty fines on both VoetbalTV and the KNLTB in this context.

The question whether a commercial interest can be a "legitimate interest" has been a point of discussion for some time now. Preliminary questions regarding this discussion have now been submitted to the Court of Justice of the EU. It is however expected that it is some time away before the CJEU will answer those questions. In this blog we will zoom in on the current situation. 

The AP's view on commercial interests

The AP is not quick to designate an interest to be a legitimate interest. The AP believes that the interest in question must be named in legislation or elsewhere in law as a legal interest. In addition, in its published view on legitimate interests, the AP explicitly excludes "merely serving purely commercial interests and profit maximization" from qualifying as a legitimate interest.

The European Data Protection Board (EDPB) has also commented on what it believes should be understood by the term "legitimate interest." The EDPB tends to interpret this term much more broadly than the AP. According to the EDPB, not only legal, but also all kinds of factual, economic and idealistic interests qualify as legitimate interest.

In addition, the Court of Justice has already confirmed several times that member states are not free to categorically exclude in advance reliance on the legitimate interest for certain categories of processing, and that the assessment of whether a particular interest is a legitimate interest must be tested negatively. The latter implies testing whether an interest is contrary to the law. Finally, the CJEU has also already ruled that Google may collect personal data from its commercial considerations (see CJEU Google Spain). It can also be argued under the GDPR itself that the term legitimate interest should be understood more broadly than the AP suggests. For example, recital 47 of the GDPR states that "direct marketing" is an example of a legitimate interest.

All in all, therefore, the AP's view on this point seems too narrow. In that context, the European Commission has already written a letter warning the AP that the strict interpretation of the GDPR endangers the internal market and hinders free enterprise. In doing so, the European Commission points out that commercial considerations can indeed be a legitimate interest.

VoetbalTV and the KNLTB both went to court because they disagreed with the fine imposed on them.

VoetbalTV

VoetbalTV provided a platform that allowed people to watch amateur soccer matches online. No prior consent was sought from the soccer players for filming the match, as VoetbalTV believed it had a legitimate interest in recording the matches. The AP believed this constituted a violation of Article 6 of the GDPR.

The Utrecht District Court ruled that the AP used too narrow a definition of the term "legitimate interest." The Court also considers that there is no question of a purely commercial interest on the part of VoetbalTV. As a result, the Court concludes that the AP used a wrong interpretation of the term "legitimate interest" and dismisses the fine. Next, the AP asks the highest administrative court for an opinion. Unfortunately, the highest administrative court did not rule on whether a purely commercial interest can be a legitimate interest. The highest administrative court ruled that VoetbalTV's interest is not purely commercial at all and thus does not get to the key question.

The KNLTB

In connection with roughly the same discussion as between VoetbalTV and the AP, the KNLTB also went to court. The Amsterdam District Court then took it upon itself to have this discussion settled once and for all by the European Court of Justice. It asked the Court of Justice to explain exactly how the term "legitimate interest" should be interpreted. On average, it takes 17 months for the Court of Justice to answer preliminary questions, so presumably we will have to be patient for a while.

What can you now base your processing on?

After reading this blog, it is understandable that you have doubts about whether you have chosen the right basis for your processing operations based on the legitimate interest. Unfortunately, there is no general answer to the question if this is legitimate. That will have to be assessed on a case-by-case basis. However, we do believe that in many cases a legitimate interest can be invoked. This always requires a certain balancing of interests, which can be recorded in an "LIA" (legitimate interest assessment). Sometimes other legislation is also relevant, such as the Telecommunications Act (spam ban) when sending a newsletter.

We are happy to help you with any questions regarding the possibility to invoke your legitimate interest as a processing ground, and assist in performing the aforementioned LIA. Please feel free to contact privacy@ploum.nl.