ECJ interprets "legitimate interest" in accordance with Art. 6 para. 1 lit. f GDPR

October 14, 2024

Categories:

Data protection in Europe, GDPR

When is there a legitimate interest? The European Court of Justice (ECJ) had defined the term in accordance with Art. 6 para. 1 lit. f GDPR to be interpreted. Specifically, the question was whether a sports association personal data of its members without their express Consent to sponsors for commercial purposes.

Association passes on member data to sponsors

In 2018, the Royal Dutch Lawn Tennis Association (Koninklijke Nederlandse Lawn Tennisbond, KNLTB) submitted personal data of its members to two sponsors:

SportshopsDirect BV (TennisDirect), a company that sells sporting goods.
The KNLTB provided TennisDirect with the names, addresses and places of residence of its members for the mailing of a promotional letter. TennisDirect in turn sent this data to the postal service provider PostNL.
Nederlandse Loterij Organisatie BV (NLO), the largest provider of games of chance and casino games in the Netherlands.
In addition to the names, addresses and places of residence of its members, the KNLTB also provided the NLO with their dates of birth, landline and cell phone numbers, e-mail addresses and the names of the tennis clubs to which these members belonged. The purpose of this Transmission was a telephone advertising campaign in which the NLO passed this data on to the call centers it commissioned.

The KNLTB received a fee from the sponsors for providing the personal data.

Following complaints from some members of the KNLTB, the Dutch data protection supervisory authority Autoriteit Persoonsgegevens (AP) found that the KNLTB violated Art. 6(1)(a) and (f) in conjunction with Art. 5(1)(a) GDPR. GDPR because it processed the personal data of its members without their consent. Consent and without a lawful basis. The AP therefore imposed a fine of EUR 525,000 on the KNLTB in a decision dated December 20, 2019.

The KNLTB appealed against this decision to the Rechtbank Amsterdam (District Court of Amsterdam, Netherlands).

Legitimate interest as a legal basis for the disclosure of data

In the opinion of the KNLTB, the provision of the data was based on a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. This interest is, on the one hand, to create a close bond between the association and its members and, on the other hand, to be able to offer members added value for their membership in the form of discounts and offers from partners that enable members to play tennis at a favorable and affordable price.

The AP, on the other hand, is of the opinion that only interests that are part of the law, statutory and defined in a law legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR are. They must be interests which are regarded by the EU legislature or the national legislature as worthy of protection and which are to be assessed by reference to a "positive criterion". In the present case, these are not such interests.

Since the District Court of Amsterdam had doubts as to the interpretation of the term "legitimate interests" within the meaning of Art. 6 para. 1 lit. f GDPR it stayed the proceedings and referred the following questions to the ECJ for a preliminary ruling:

How did the referring court define the concept of 'legitimate interest' within the meaning of the first subparagraph of Article 6(1)(f)? GDPR to lay out?
Is that term to be interpreted as the defendant interprets it? Does it cover only interests that are statutory and defined in a statute?
Or can any interest be a legitimate interest as long as it is not contrary to the law? More specifically: Are a purely commercial interest and the interest at hand, namely the provision of personal data for a fee without the consent of the data subject, to be classified as a legitimate interest under certain circumstances? If so, what circumstances determine whether a purely commercial interest is a legitimate interest?

Requirements for legality of the Processing pursuant to Art. 6 para. 1 lit. f GDPR

According to the ECJ, the Processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR lawful under three conditions:

From the Processing The data controller or a third party must have a legitimate interest.
The interest of a controller does not have to be regulated by law. According to the ECJ, a broad spectrum of interests can generally be considered legitimate. This also includes economic interests. However, the legitimate interest asserted must be lawful.
The Processing of the personal data must be necessary for the realization of the legitimate interest.
The prerequisite of the Necessity of data processing together with the principle of "Data minimization", which is set out in Art. 5 para. 1 lit. c GDPR and requires that personal data "adequate and relevant to the purpose and limited to what is necessary for the purposes of the Processing necessary".
In this regard, the ECJ writes in its judgment: "As regards the condition of Necessity this Processing interest concerned, and in particular the existence of means which are equally appropriate and less intrusive on the fundamental rights and freedoms of the persons concerned, it must be held that a sports federation such as the KNLTB, which personal data of its members to third parties for a fee, in particular it would be possible to inform its members in advance and ask them whether they want their data to be passed on to third parties for advertising or marketing purposes. Third be passed on. This solution would allow the members concerned to be informed in accordance with the principle of Data minimization retain control over the disclosure of their personal data and thus limit the disclosure of this data to what is actually necessary and relevant for the purposes for which this data is transmitted and processed."

The interests or fundamental rights and freedoms of the person whose data is to be protected must not outweigh the legitimate interest of the controller or a third party.
The ECJ found that the members of the KNLTB could not reasonably expect that their personal data would be disclosed without their consent. Consent on Third be passed on. The Court was particularly critical of the transfer of data to the NLO, a provider of gambling services, as this could put members in unexpected situations, such as possible advertising measures in the gambling sector, which could have potentially harmful effects.

In its judgment, the ECJ interprets Art. 6 para. 1 lit. f GDPR that "a Processing personal data, which consists of personal data of the members of a sports association in pursuit of the economic interest of the controller in return for payment can only be regarded as necessary within the meaning of this provision for the purposes of the legitimate interests pursued by the controller if the Processing is absolutely necessary for the realization of the legitimate interest in question and provided that, in view of all relevant circumstances, the interests or fundamental rights and freedoms of these members do not outweigh the legitimate interest. Although this provision does not require that such an interest be determined by law, it does require that the legitimate interest asserted is lawful."

Reading tip: EDSA published Guidelines on the legitimate interest

Legitimate interest relevant for practice

This ruling has far-reaching implications for the practice of data processing by sports clubs and other organizations that regularly personal data of its members. It clarifies that economic interests alone are not a sufficient basis for the Processing personal data without Consent of the data subjects. In all cases, organizations must carefully weigh up the interests and ensure that the rights and freedoms of the data subjects are safeguarded.

The obtaining of an express Consent of the persons concerned thus remains in many cases the legally most secure basis for the Processing personal data, in particular for commercial purposes.

The ruling emphasizes the importance of data protection and the protection of fundamental rights in the context of the Processing of personal data and sets clear limits on the use of data for commercial purposes.

Source: ECJ ruling C-621/22 of October 4, 2024

Tags: