DATA PROTECTION
EU Court of Justice: the limits of legitimate interest as a basis for the lawfulness of processing for marketing and commercial purposes.
An association of Dutch tennis clubs communicated the data of its members, without their consent, to external third parties (certain sponsors), including a company marketing sports products, and to ‘Nederlandse Loterij Organisatie BV’, the largest gambling and casino games company in the Netherlands. The latter paid the association a fee for making available the personal data of its members (names, addresses, dates of birth, landline and mobile telephone numbers, e-mails). This data was then used for a campaign of promotional calls by the call centres used by the gaming company.
Following the sanction imposed by the Dutch Garante on the sports association, the latter challenged the measure, arguing that the processing was lawful on the basis of legitimate interest under Article 6(1)(f) of the GDPR.
The judges therefore turned to the Court of Justice asking how the expression ‘legitimate interest’ in point (f) of the first paragraph of Article 6(1) of the GDPR should be interpreted, and in particular whether ‘legitimate interest’ should be understood to mean exclusively an interest that is enshrined and determined by a law, which is considered deserving of protection by the Union legislator or the national legislator or whether the legitimate interest need not necessarily derive from a fundamental right or a legal principle, but any interest may constitute a legitimate interest unless it is contrary to law, and that interest must therefore be assessed according to a ‘negative criterion’.
The Dutch courts ask in particular whether a strictly commercial interest and interest such as the one at issue, namely the provision of personal data in return for payment without the data subject's consent, may in certain circumstances be regarded as a legitimate interest. If so, what circumstances determine whether a strictly commercial interest is a legitimate interest.
The EU Court has clarified that a processing of personal data consisting in the communication of personal data of members of a sports federation against payment in order to satisfy a commercial interest of the data controller (that is to say, the association transmitting the data) may be regarded as necessary for the purposes of the legitimate interest pursued by that controller only on condition that that processing is strictly necessary for the purposes of the legitimate interest in question and that, in the light of all the relevant circumstances, the interests or the fundamental freedoms and rights of those members do not override that legitimate interest.
Although that provision does not require that such an interest be determined by law, it does require that the legitimate interest invoked be lawful. Moreover, if it is possible to ask data subjects for their consent to the processing and communication of their data for marketing purposes, then legitimate interest is not a basis for the lawfulness of processing that can be properly invoked and used in such cases.
Finally, the judgment emphasises that legitimate interest cannot be a basis for the processing of data of data subjects if there is communication to a gambling company, given the risk of exposing those persons (then recipients of commercial calls) to the danger of developing gambling diseases.
Following the sanction imposed by the Dutch Garante on the sports association, the latter challenged the measure, arguing that the processing was lawful on the basis of legitimate interest under Article 6(1)(f) of the GDPR.
The judges therefore turned to the Court of Justice asking how the expression ‘legitimate interest’ in point (f) of the first paragraph of Article 6(1) of the GDPR should be interpreted, and in particular whether ‘legitimate interest’ should be understood to mean exclusively an interest that is enshrined and determined by a law, which is considered deserving of protection by the Union legislator or the national legislator or whether the legitimate interest need not necessarily derive from a fundamental right or a legal principle, but any interest may constitute a legitimate interest unless it is contrary to law, and that interest must therefore be assessed according to a ‘negative criterion’.
The Dutch courts ask in particular whether a strictly commercial interest and interest such as the one at issue, namely the provision of personal data in return for payment without the data subject's consent, may in certain circumstances be regarded as a legitimate interest. If so, what circumstances determine whether a strictly commercial interest is a legitimate interest.
The EU Court has clarified that a processing of personal data consisting in the communication of personal data of members of a sports federation against payment in order to satisfy a commercial interest of the data controller (that is to say, the association transmitting the data) may be regarded as necessary for the purposes of the legitimate interest pursued by that controller only on condition that that processing is strictly necessary for the purposes of the legitimate interest in question and that, in the light of all the relevant circumstances, the interests or the fundamental freedoms and rights of those members do not override that legitimate interest.
Although that provision does not require that such an interest be determined by law, it does require that the legitimate interest invoked be lawful. Moreover, if it is possible to ask data subjects for their consent to the processing and communication of their data for marketing purposes, then legitimate interest is not a basis for the lawfulness of processing that can be properly invoked and used in such cases.
Finally, the judgment emphasises that legitimate interest cannot be a basis for the processing of data of data subjects if there is communication to a gambling company, given the risk of exposing those persons (then recipients of commercial calls) to the danger of developing gambling diseases.
