A commercial interest can after all be a legitimate interest

08/10/2024 – On October 4^th, the Court of Justice of the European Union (CJEU) issued a ruling in the long-awaited case between the Royal Dutch Lawn Tennis Association (KNLTB) and the Dutch Data Protection Authority (AP). The Court ruled unequivocally: a commercial interest may be considered a legitimate interest. In doing so, the CJEU puts an end to the AP’s standard interpretation of what constitutes a legitimate interest.

Background

The case arose from a conflict between the KNLTB and the AP. In December 2019, the AP imposed a fine of €525,000 on the KNLTB for selling personal data of its members - such as names, addresses, and phone numbers - without consent to two sponsors: TennisDirect (sports equipment retailer) and the Dutch Lottery Organization (provider of lottery and casino games). While a lucrative deal for the tennis association, the AP opposed this data-sharing practice. The AP argued that such a commercial interest could not constitute a legitimate interest as a legal basis for data processing under Article 6(1)(f) of the GDPR, as it was not explicitly recognized by law. According to the AP, only interests reflected in the law can qualify as legitimate interests. The KNLTB, on the contrary, argues that any interest can be justified, provided it does not conflict with the law. Both sides therefore have a different viewpoint as to whether an interest may qualify as ‘justified’.

The KNLTB appealed against this decision before the Court of Amsterdam, which subsequently referred the matter to the CJEU for clarification on the interpretation of ‘legitimate interest’ - specifically, whether a purely commercial interest, such as direct marketing, could qualify as a legitimate interest and under what circumstances.

The die is cast: commercial interests can be legitimate

On October 4^th, the CJEU brought clarity: as long as an interest does not conflict with the law, a commercial interest can indeed constitute a legitimate interest, even if that interest is not specifically recognized by law. However, this does not mean that organisations may now use personal data for their commercial interests without restraint. The CJEU reiterates that three strict conditions must be met for an organization to rely on a legitimate interest as a basis for data processing. This is also known as the three-step test: 

1. Legitimate interest: The CJEU rules that the GDPR does not define the term ‘legitimate interest’ and that it can cover a wide range of interests, including commercial ones. The GDPR does not require the legitimate interest to be established by law, and it actually does specifically mention direct marketing in a recital as an example of a legitimate interest. It is however necessary that the interest in question is lawful and in accordance with the principles of the GDPR.
2. Necessity: The data processing must be strictly necessary to achieve the legitimate interest. This means that less drastic alternatives should not be at hand. The CJEU noted that the KNLTB could have opted for a less intrusive method, such as seeking prior consent from its members before sharing their data for marketing purposes, rather than disclosing it without any notification. The CJEU stresses that this alternative would have been less detrimental to the rights and freedoms of the data subjects.
3. Balancing of interests: The court states that the balancing of interests must consider the reasonable expectations of the data subjects, the scope of the processing and its effects. The Court of Amsterdam must assess whether the members' right to privacy outweighs the KNLTB's commercial interest in this case. In doing so, it must specifically consider whether the members could have expected that their personal data would be provided to third parties for advertising and marketing purposes against payment. Additionally, the fact that data was shared with a gambling provider must be taken into account, as this poses specific risks to individuals, such as a heightened risk of gambling addiction.

The CJEU clarifies that the strict conditions must be carefully weighed. In other words, organizations wishing to process personal data for commercial purposes still face two hurdles to overcome, even in light of this ruling. Despite the recognition of commercial interests as a potential legitimate interest, the KNLTB has not fully prevailed. It is now up to the Court of Amsterdam, which must adjudicate further in the appeal that led to this preliminary ruling. The CJEU’s judgment provides much-needed guidance. In addition, the AP will have to adjust its standard interpretation to align it with the ruling.

Handling commercial interests responsibly

Although the use of commercial interest has ostensibly been broadened, the legal landscape remains challenging. Any organization considering processing personal data based on a commercial interest should act carefully, keeping the following in mind:

• Assess and describe the legitimate interest: Clearly define why the processing is necessary and what specific interest your organization is pursuing.
• Conduct a Legitimate Impact Assessment (LIA): This helps to identify the potential risks to the rights and freedoms of data subjects and facilitates a careful balancing of interests when you want to use a legitimate interest as a processing ground.
• Ensure transparency: Inform data subjects about the processing of their data and provide them with the opportunity to object.