Purely commercial interest also a legitimate interest? Council of State leaves the question unanswered.

On 27 July 2022, the Dutch Council of State ("Council"), the highest administrative court in the Netherlands, confirmed that the Dutch Data Protection Authority ("AP") wrongly imposed a €575,000 fine on VoetbalTV B.V. ("VoetbalTV"). It was anticipated that the Council would answer the question whether the AP rightly or wrongly believes that a purely commercial interest cannot be a legitimate interest within the meaning of the General Data Protection Regulation ("GDPR"). But that question remains unanswered.

1. Background

Under the GDPR, personal data may be processed only if there is a legal basis for doing so. Legitimate interest is one of those bases. Three conditions must be met in order to successfully invoke this legal basis:

• the interest pursued by the controller must be a legitimate interest;
• the processing must be necessary for the pursuit of that legitimate interest; and
• the data subject’s interests may not outweigh that legitimate interest.

The AP believes that purely commercial interests cannot be legitimate interests. According to the AP, a legitimate interest is an interest that has been designated as a legal interest in legislation or other rules of law. The AP does not consider purely commercial interests to be such legitimate interests.

On 16 July 2020, the AP imposed a €575,000 fine on VoetbalTV for unlawfully processing personal data. VoetbalTV was a video platform and social medium for amateur football that made video recordings of amateur football matches on behalf of football clubs. Such recordings could also be viewed online. The AP found that VoetbalTV had unlawfully processed personal data, because VoetbalTV had no legitimate interest in that processing. The AP qualified the interests of VoetbalTV as purely commercial in nature and found that a purely commercial interest can in no event be considered a legitimate interest.

VoetbalTV appealed the decision. On 23 November 2020, the District Court of Midden-Nederland ruled that the AP had failed to exercise due care in arriving at its decision to impose the fine and therefore annulled the decision. The Court ruled that the AP had applied an incorrect interpretation. It found that a legitimate interest is an interest that is not in violation of the law rather than an interest that follows from the law. The Court also ruled that the AP had insufficiently considered the second and third conditions of the legal basis of legitimate interest.

The AP appealed the Court’s decision.

2. Appeal

On appeal, the AP emphasized its position that VoetbalTV had no legitimate interest because its interest was purely commercial in nature. However, VoetbalTV explained that its interests were not purely commercial, but served (i) to increase the involvement in and enjoyment of the game of football; (ii) to enable football clubs and third parties to make technical analyses; and (iii) to make it possible to watch matches also online.

The Council first confirmed that it is up to the controller to determine what the interest in the processing of personal data is, why that processing is necessary and why it should take place. It is then up to the AP to check those arguments. The Council offers the AP various tools for doing so: the AP must then assess what the controller actually does, whether this practice is in keeping with the stated interests, whether the processing of personal data actually promotes those interests, and whether those interests are legitimate.

The Council subscribed to VoetbalTV’s position that VoetbalTV does not have a purely commercial interest. Since the AP had therefore failed to consider all the legitimate interests of VoetbalTV, the Council found that the AP had ruled on incorrect grounds that VoetbalTV had not acted in accordance with the conditions of the legal basis of legitimate interest. The Council also noted that the question whether a purely commercial interest can be a legitimate interest in and of itself therefore need not be answered. The Council furthermore did not consider it necessary for the assessment of the case to request the Court of Justice of the European Union to issue a preliminary ruling.

The Council dismissed the AP's appeal and upheld the judgment passed by the District Court of Midden-Nederland.

3. Analysis

Unfortunately, the judgment does not answer the pressing question whether the AP rightly or wrongly believes that a purely commercial interest cannot be a legitimate interest. The AP was recently reprimanded by the European Commission for its restrictive interpretation of a legitimate interest.

The judgment does contain some relevant points, however.

First, the Council appears to acknowledge that combined interests, which are partly commercial and partly of a different nature, can in any event be legitimate interests: by noting that the AP had not sufficiently investigate the second and third conditions, the Council appears to assume that such interests satisfy the first condition.

Second, the Council indicated how the AP should assess whether a legitimate interest exists. The AP’s assessment can be tested along this line in court. These tools may also serve as guidance for companies that process personal data.

Since the question whether a purely commercial interest can be a legitimate interest has not been answered, it remains important for the time being to thoroughly examine whether processing of personal data for commercial interests also serves other interests. Third-party interests may also play a role in this regard.

The Council also emphasized that legal basis of legitimate interest breaks down in three conditions and that all three of those conditions must be met. VoetbalTV cannot base its processing on the legal basis if the second and third conditions are not met, for instance, because the interests of the individuals involved outweigh VoetbalTV's interests. The Council did not have to rule on this issue.

Finally, the Council implicitly emphasized the importance of accountability by finding that the controller must state what its interest is, why the processing is necessary and why it must act accordingly. Any party that processes personal data is therefore well advised to perform what is known as a “legitimate interest assessment” and to document that assessment before basing the processing of personal data on the legal basis of legitimate interest.

This is not yet the end of the matter. The question whether a purely commercial interest can be a legitimate interest remains unanswered. In our view, it can indeed qualify as a legitimate interest. We believe that the safeguards that the AP appears to be looking for are sufficiently provided by the necessity test and the weighing of interests. A compelling privacy interest may then outweigh commercial interests, including significant commercial.