On 23 November 2020 a Dutch District Court (‘Court’) nullified a decision of the Dutch Data Protection Authority to impose an administrative fine on a company called VoetbalTV. This is the first Dutch judgment on fines under the General Data Protection Regulation (‘GDPR’).
The now bankrupt VoetbalTV (in English: FootballTV) was an internet platform on which amateur football matches were broadcasted. The DPA is of the opinion that VoetbalTV did not have a valid basis for making recordings and broadcasting soccer matches and therefore unlawfully processed personal data. According to the DPA, the recordings violated the privacy of a large number of data subjects, including many underage football players. The DPA therefore imposed a fine of € 575,000.
VoetbalTV has appealed the administrative fine of the DPA. It argues, among other things, that it does have a legitimate interest to process personal data. The DPA disagrees and states that the mere monetization of personal data can never constitute a legitimate interest. In doing so, the DPA argues in line with its earlier published interpretation on ‘legitimate interest’.
Three conditions must be met when an organization want to use ‘legitimate interest’ as a legal basis for its processing activities (‘three-step-test’):
- The personal data must be processed in pursuit of a legitimate interest (purpose test);
- The processing of these data must be necessary to promote that legitimate interest (necessity test); and
- The fundamental rights and freedoms of the data subjects may not take precedence over that legitimate interest (balancing test).
With regard to the first criterion, the DPA states in its published interpretation on legitimate interest, and later also in the lawsuit against VoetbalTV, that the interests of the data controller or a third party only qualify as legitimate if those interests have been designated as a legal interest in (general) legislation or elsewhere in the law. According to the DPA, the data controller or third party must be able to invoke a (written or unwritten) rule of law or principle of law. The mere serving of purely commercial interests and profit maximization are therefore not legitimate.
This strict interpretation of the ‘legitimate interest’ by the DPA was already criticized at the time. Partly because recital 47 of the GDPR mentions ‘direct marketing’ as a possible legitimate interest and direct marketing is pre-eminently commercial in nature. This also played a role in the decision of the DPA to impose an administrative fine on the Dutch tennis association at the end of 2019. Here, too, the final word does not yet seem to have been said. More information on that decsion can be found here.
Judgment of the court
In the proceedings before the court, the DPA argued that the interest that VoetbalTV pursues with the processing of personal data is only a commercial interest, in which it exploits personal data of others, including many minors. According to the DPA, that interest is not legitimate. Because the first condition of the three-step-test was not met, the DPA found VoetbalTV to be unlawfully processing personal data and imposed a fine.
In its judgment, the court made clear that it did not agree with the (standard) interpretation of the DPA. It ruled that categorically excluding a certain interest in advance as legitimate is not allowed.
According to the court, a party must determine itself what its legitimate interest is when processing personal data, and that party must also act upon such interest in practice. The processing of personal data may not violate the law, nor may it go beyond the party’s statutory purpose. In short: it cannot be in conflict with the law. The concept of ‘legitimate interest’ serves primarily as an external boundary for the assessment and not as a threshold, as in the opinion of the DPA.
The Court rules that the assessment of the DPA in this case is based on a misinterpretation of the ‘legitimate interest’ basis and is therefore contrary to Article 6(1)(f) GDPR. Since the DPA did not fully examine the processing of personal data and stopped at the conclusion that VoetbalTV does not have a legitimate interest, its decision to impose an administrative fine was not taken with sufficient care and can therefore, in the opinion of the court, not be upheld.
According to the Court, the DPA should have examined what VoetbalTV actually does and whether the purposes are in accordance with its articles of association and are actually being served by the processing of personal data. If the DPA had based itself on the interests as stated by VoetbalTV (including increasing the involvement and enjoyment of football fans and being able to perform technical analyses for/by trainers and analysts of football clubs), the DPA could have carried out a necessity test and balancing test after all.
Based on this judgment, the question whether a party has a legitimate interest should be assessed on the basis of a negative test. This test comes down to the fact that no interest may be pursued that is contrary to the law.
What does this judgment mean in practice?
This judgment is of great importance. In contrast to the standard interpretation of the DPA, there is now a ruling of a court from which it follows that the mere serving of a commercial interest cannot be excluded as ‘legitimate’ in advance. This offers opportunities for organizations that want to process personal data for commercial purposes.
Please note: this does not mean that every commercial interest can be based on a ‘legitimate interest’ as referred to in Article 6 GDPR. To do so, the other two conditions must also be met. In other words: the processing must be necessary to pursue the legitimate interests of the data controller or third party (necessity test) and the fundamental rights and freedoms of data subjects must not take precedence over these interests (balancing test).
If your organization wants to use this basis for its processing activities, all three steps will have to be completed successfully.