Not All Commercial Interests Are Created Equally Under The Legitimate Interest For Personal Data Processing, The CJEU Says In Koninklijke Nederlandse Lawn Tennisbond V Autoriteit Persoonsgegevens

1. Introduction

The Court of Justice of the European Union adopted its decision in Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens (C-621/222) regarding how the purely commercial interest can be a legitimate interest as a legal basis for personal data processing under Article 6(1)(f) of the General Data Protection Regulation (GDPR). This short blogpost argues that while the CJEU accepts the broad notion of commercial interest under the condition of legitimate interest, it limits the scope of the use of commercial interest by referring to the necessity of processing and balancing test under Article 6(1)(f) of the GDPR.

2. The brief summary of the case

In this case, the Royal Dutch Tennis Association (KNLTB) disclosed its members' personal data to two sponsors, TennisDirect and Nederlandse Loterij Organisatie (NLO), for marketing purposes in 2018 without the members' consent. The KNLTB received payment for this disclosure, leading to complaints from members. The Dutch Data Protection Authority (AP) found the KNLTB violated the General Data Protection Regulation (GDPR) by lacking a legal basis for this data sharing and fined the KNLTB €525,000. The KNLTB contested the decision, arguing that the disclosure served a legitimate interest under Article 6(1)(f) of the GDPR. The AP, however, maintained that legitimate interests must be legally grounded. The Amsterdam District Court referred the case to the Court of Justice of the European Union, seeking clarification on whether purely commercial interests, like data sharing for a consideration, can qualify as a legitimate interest under GDPR.

3. The analysis of the case

The CJEU judgment clarifies that sharing personal data to third parties in the exchange of financial compensation for marketing and advertising purposes is not inherently against the law, provided that the processing meets the requirements of the GDPR.

Specifically, the Court confirms that a purely commercial interest can constitute a legitimate interest under Article 6(1)(f) of the GDPR. This interpretation suggests a broad application of legitimate interests but emphasizes that fulfilling the second and third requirements of legitimate interest is as well as other GDPR requirements such provision of the information to the data subjects (Article 13(1)(d) of GDPR).

The second requirement of legitimate interest refers to the necessity of personal data processing, which must adhere to the data minimization principle and respect the reasonable expectations of the data subjects. For instance, it raises questions about whether sharing specific data, such as dates of birth or physical addresses in the case, is necessary for advertising purposes. This step invites scrutiny on the extent of data shared and whether it aligns with the principle of necessity.

The third requirement focuses on the balancing of interests, particularly the proportionality of the data processing. The Court draws a distinction between different types of commercial interests, highlighting that not all are equally valid. For example, sharing data with a sports equipment company may align with the reasonable expectations of tennis federation members, but sharing the same data with a gambling game company raises more significant concerns. The Court stresses that data controllers must consider not only the rights and freedoms of the data subjects but also the potential harmful effects, such as the risk of gambling addiction (para. 54 of the judgment). Therefore, the impact of such data sharing on data subjects plays a crucial role in determining whether the processing is lawful.

4. Conclusion and takeaways:

To summarise, given all of the requirements of a legitimate interest under Article 6(1)(f) of the GDPR, not all purely commercial interests that are not prohibited by law are created equally. There are limitations to the use of commercial interests. Data minimisation, reasonable expectations of data subjects, and a broad interpretation of the potential negative impact of data sharing on data subjects are particularly compelling challenges to use commercial interest in the form of legitimate interest as a legal basis for personal data processing.

Here are two key takeaways from the judgment:

• Differentiation in the nature of commercial interests: The Court emphasizes that not all commercial interests are equally valid when it comes to justifying personal data processing under the GDPR. Data sharing with a company that has a close and relevant relationship between the data controller and the data subjects (e.g., a sports equipment or clothing company for tennis players) might be seen as more legitimate, since it aligns with the reasonable expectations of the data subjects. In contrast, sharing personal data with unrelated entities, such as a gambling game company, does not meet the same standard. The Court suggests that processing for purely commercial gain must be closely tied to the context in which the data subjects expect their data to be used.
• Impact of data sharing on the data subjects: The judgment makes clear that the potential risks and harms to the data subjects must be considered when balancing interests. In the case of data sharing with a gambling company, the Court highlights the risk of exposing individuals to gambling addiction, a harmful consequence that goes beyond mere commercial interests. This contrasts with data sharing for marketing sports equipment, where the potential negative impact on the data subject is considerably lower. Therefore, when assessing whether a legitimate interest justifies data processing, the actual or potential impact of that processing on the individuals concerned is conclusive to decide on the appropriateness of the legitimate interest as a legal basis.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.