When is there a legitimate interest? As part of a request for a preliminary ruling, the European Court of Justice (ECJ) had to interpret the term in accordance with Art. 6 para. 1 lit. f GDPR. Specifically, the question was whether a sports association may pass on personal data of its members to sponsors for commercial purposes without their express consent.
Association passes on member data to sponsors
In 2018, the Royal Dutch Lawn Tennis Association (Koninklijke Nederlandse Lawn Tennisbond, KNLTB) transmitted the personal data of its members to two sponsors:
- SportshopsDirect BV (TennisDirect), a company that sells sporting goods.
The KNLTB provided TennisDirect with the names, addresses and places of residence of its members for the mailing of a promotional letter. TennisDirect in turn sent this data to the postal service provider PostNL. - Nederlandse Loterij Organisatie BV (NLO), the largest provider of games of chance and casino games in the Netherlands.
In addition to the names, addresses and places of residence of its members, the KNLTB also provided the NLO with their dates of birth, landline and cell phone numbers, email addresses and the names of the tennis clubs to which these members belonged. The purpose of this transfer was a telephone advertising campaign in the context of which the NLO passed this data on to the call centers it had commissioned.
The KNLTB received a fee from the sponsors for providing the personal data.
Following complaints from a number of KNLTB members, the Dutch data protection supervisory authority Autoriteit Persoonsgegevens (AP) found that the KNLTB had violated Art. 6 para. 1 lit. a and f in conjunction with Art. 5 para. 1 lit. a GDPR because it had disclosed the personal data of its members without their consent and without a lawful basis. The AP therefore imposed a fine of EUR 525,000 on the KNLTB in a decision dated December 20, 2019.
The KNLTB appealed against this decision to the Rechtbank Amsterdam (District Court of Amsterdam, Netherlands).
Legitimate interest as a legal basis for the disclosure of data
According to the KNLTB, the provision of the data was based on a legitimate interest within the meaning of Art. 6 para. 1 lit. f GDPR. This interest consisted, on the one hand, in establishing a close relationship between the association and its members and, on the other hand, in being able to offer members added value for their membership in the form of discounts and offers from partners that enable members to play tennis at a reasonable and affordable price.
The AP, on the other hand, is of the opinion that only interests that are statutory and laid down in a law are legitimate interests within the meaning of Art. 6 para. 1 lit. f GDPR. These must be interests that are considered worthy of protection by the Union legislator or the national legislator and are to be assessed on the basis of a "positive criterion". In the present case, these are not such interests.
Since the District Court of Amsterdam has doubts regarding the interpretation of the term "legitimate interests" within the meaning of Art. 6 para. 1 lit. f GDPR, it has stayed the proceedings and referred the following questions to the ECJ for a preliminary ruling:
- How must the referring court interpret the term "legitimate interest" within the meaning of Article 6(1)(1)(f) GDPR?
- Is that term to be interpreted as the defendant interprets it? Does it cover only interests that are statutory and defined in a statute?
- Or can any interest be a legitimate interest as long as it is not contrary to the law? More specifically: Are a purely commercial interest and the present interest, namely the provision of personal data for a fee without the consent of the data subject, to be classified as a legitimate interest in certain circumstances? If so, what circumstances determine whether a purely commercial interest is a legitimate interest?
Requirements for lawfulness of processing in accordance with Art. 6 para. 1 lit. f GDPR
According to the ECJ, the processing of personal data pursuant to Art. 6 para. 1 lit. f GDPR is lawful under three conditions:
- The controller or a third party must have a legitimate interest.
The interest of a controller does not have to be regulated by law. According to the ECJ, a broad spectrum of interests can generally be considered legitimate. This also includes economic interests. However, the legitimate interest asserted must be lawful. - The processing of personal data must be necessary for the realization of the legitimate interest.
The requirement of necessity of data processing must be examined together with the principle of "data minimization", which is enshrined in Art. 5 para. 1 lit. c GDPR and requires that personal data is "adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed".
In this regard, the CJEU writes in its judgment: "As regards the condition of necessity of that processing for the purposes of the interest in question and, in particular, the existence of means which are equally appropriate and less intrusive on the fundamental rights and freedoms of the persons concerned, it should be noted that a sports association such as the KNLTB, which wishes to disclose the personal data of its members to third parties in return for payment, could, in particular, inform its members in advance and ask them whether they wish their data to be disclosed to third parties for advertising or marketing purposes. This solution would allow the members concerned to retain control over the disclosure of their personal data, in accordance with the principle of data minimization, thus limiting the disclosure of this data to what is actually necessary and relevant for the purposes for which this data is transmitted and processed."
- The interests or fundamental rights and freedoms of the person whose data is to be protected must not outweigh the legitimate interest of the controller or a third party.
The ECJ found that the members of the KNLTB could not reasonably expect their personal data to be passed on to third parties without their consent. The Court was particularly critical of the transfer of data to the NLO, a provider of gambling services, as this could put members in unexpected situations, such as possible advertising measures in the gambling sector, which could have potentially harmful effects.
In its judgment, the ECJ interprets Article 6(1)(f) GDPR as meaning "that processing of personal data consisting of disclosing personal data of members of a sports association in pursuit of the commercial interest of the controller in return for payment may be regarded as necessary for the purposes of that provision for the purposes of the legitimate interests pursued by the controller only if the processing is strictly necessary for the purposes of the legitimate interest in question and if, having regard to all the relevant circumstances, the interests or fundamental rights and freedoms of those members do not override the legitimate interest. Although this provision does not require that such an interest be determined by law, it does require that the legitimate interest asserted is lawful."
Reading tip: EDPB publishes guidelines on legitimate interest
Legitimate interest relevant for practice
This ruling has far-reaching implications for the practice of data processing by sports clubs and other organizations that regularly process the personal data of their members. It clarifies that economic interests alone are not a sufficient basis for processing personal data without the consent of the data subjects. In any case, organizations must carefully weigh up the interests and ensure that the rights and freedoms of the data subjects are safeguarded.
Obtaining the express consent of the data subjects therefore remains the legally most secure basis for the processing of personal data in many cases, particularly for commercial purposes.
The ruling emphasizes the importance of data protection and the protection of fundamental rights in the processing of personal data and sets clear limits for the use of data for commercial purposes.
English 
German 
Italian 
French