The Court of Justice of the European Union decides that “commercial interests” can constitute a legitimate interest under article 6(1)(f) GDPR

Information Law

By Jeremy Ogilvie-Harris

In a recent case, C‑621/22 Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens [2024] ECLI:EU:C:2024:857, the Court of Justice of the European Union (‘CJEU’) has considered whether “commercial interests” can constitute a legitimate interest for the purpose of article 6(1)(f) GDPR and held that, in principle, they can be, but subject to restrictions.

While the UK is no longer a member of the EU, this judgment of the CJEU remains relevant for two reasons:

• The article 6(1)(f) of the UK GDPR is the same as article 6(1)(f) GDPR. Courts are not bound by, but may take into account, decisions of the CJEU made post-31 December 2020 (IP completion day): section 6(1)-(2) of the European Union (Withdrawal) Act 2018.
• When the Information Commissioner’s Office is determining its enforcement policy or what enforcement action to take, it may take into account decisions of the CJEU.

Summary

These proceedings concerned the disclosure of data, for consideration, by the Koninklijke Nederlandse Lawn Tennisbond (the Royal Dutch Law Tennis Association, ‘KNLTB’) to a sportwear company and “a provider of games of chance and casino games” for marketing and promotional purposes. KNLTB argued that a commercial interest was capable of being a legitimate interest for the purpose of article 6(1)(f) provided it was not contrary to law. The respondent, the Autoriteit Persoonsgegevens (the Data Protection Authority, Netherlands, ‘AP’) contended that a legitimate interest could only be such an interest where provided for by law.

The CJEU accepted KNLTB’s argument that an interest, in particular, a commercial interest, could be a legitimate interest, provided it was not contrary to law: §§47-49. However, the CJEU held that this was subject to limitations. First, in considering the necessity of processing for the legitimate interest, the referring court needed to consider whether less restrictive means could have been to pursue the commercial interest, such as obtaining the consent of the data subject prior to disclosure: §§51-52.

Secondly, in balancing competing rights and interests, the referring court should consider whether the particular disclosure and processing of the data was reasonably expected by the data subjects when their data was initially collected: §55.

Thirdly, in balancing competing rights and interests, the referring court was to consider the context and circumstances of the disclosure of data and whether there was connection to a relevant and appropriate relationship between the data subjects and the controller: §57. This did not appear to exist in relation to a tennis association disclosing information to “a provider of games of chance and casino games”.

Finally, the referring court was to consider whether any harm may arise as a result of disclosure, such as the risk of a gambling addiction: §57.

The decision in detail

These proceedings were initiated by the rechtbank Amsterdam (District Court, Amsterdam, Netherlands) making a preliminary reference to the CJEU.

KNLTB is a sports federation, whose members include  both those who join KNLTB directly and those who join their affiliated tennis associations, who automatically become members of KNLTB.

In 2018, KNLTB disclosed personal data of its members to two of its sponsors in exchange for remuneration. One of those sponsors was SportshopsDirect BV, a company that sells sports goods. The other was Nederlandse Loterij Organisatie BV, “a provider of games of chance and casino games”: §10.

The data disclosed to SportshopsDirect BV included the names, addresses and domiciles of its members so that advertising leaflets could be sent to them.  §11.

The data disclosed to Nederlandse Loterij Organisatie BV included the names, addresses and domiciles of its members, the dates of birth, fixed telephone numbers, mobile telephone number and email address of those members and the names of the tennis clubs of which they were members. §12.

Some of the members of KNLTB complained to AP who investigated and imposed a fine of €525,000 on KNLTB on the basis that they had disclosed its members’ personal data without their consent: §13.

KNLTB challenged this decision in the rechtbank Amsterdam (District Court, Amsterdam, Netherlands). KNLTB agreed that it could not rely on article 6(1)(a) (consent) but argued that the disclosure was based on a legitimate interest within the meaning of article 6(1)(f) (legitimate interest). Particularly, the interest was argued to consist of:

• creating a strong link between the association and its members; and
• being able to provide added value to their membership in the form of discounts and offers from partners enabling those members to play tennis at an affordable and accessible price.

The AP contended that these could not be legitimate interests because such an interest is only that which is “enshrined in and determined by law”: §16. In that sense, the interest had to be “regarded as worthy of protection by the EU legislature or by the national legislature, and must be assessed according to a ‘positive criterion’.”

On the other hand, KNLTB argued that a legitimate interest did not “necessarily have to derive from a fundamental right or from a legal principle, but that any interest may constitute a legitimate interest unless contrary to law”: §17. It was said to follow that the interest was to be assessed according to a “negative criterion”.

The CJEU stated the relevant legal principles for the application of article 6(1)(f):

• Under article 6(1)(f), there are three cumulative conditions for the lawful processing of data (§§36-37):
  1. The pursuit of a legitimate interest by the data controller of by a third party;
  2. The need to process personal data for the purposes of the legitimate interests pursued;
  3. The interests or fundamental freedoms and rights of the person concerned by the data protection do not take precedence over the legitimate interest of the controller or of a third party.
• As to the first condition, in the absence of a definition of “legitimate interest”, a wide range of interests is, in principle, capable of being regarded as legitimate: §38. Recital 47 made it apparent that it was not required for the interest to be provided for by law, for example, by referring to direct marketing purposes as being a legitimate interest: §39. However, the legitimate interest did need to be lawful: §40. Finally, pursuant to article 13(1)(d) the data controller was required to inform data subjects of the legitimate basis for processing when that data was collected: §41.
• As to the second condition, a court considering the necessity of processing for a legitimate interest must consider whether the interests pursed could not be achieved just as effective by other means less restrictive of the fundamental rights and freedoms of data subjects: §42. This was to be read in conjunction with the “data minimisation” principle: §43.
• The third condition required the balancing of the opposing rights and interest at issue with consideration of the particular circumstances of the particular: §44. Where a type of processing was not reasonably expected, the consequence may be that the interests and rights of the data subject override the interest of the data controller: §45.

In respect of the application of article 6(1)(f) in the present case, the CJEU gave the following guidance:

• It was possible that the commercial interests of a data controller could be a legitimate interest for the purpose of article 6(1)(f): §48.
• In particular, the commercial interest of a controller which consists of the disclosure, for consideration, of the personal data of its members to third parties for advertising or marketing purposes could constitute a legitimate interest provided that it is not contrary to the law: §47, §49. However, whether it was in fact such an interest was to be assessed by the court, on a case-by-case basis, having regard to the applicable legal framework and all the circumstances of the case.
• In assessing necessity, a less restrictive measure for those organisations wishing to disclose its members’ personal data to third parties for consideration would be “to inform its members beforehand and to ask them whether they want their data to be transmitted to those third parties for advertising and marketing purpose”: §51. This would also ensure compliance with the data minimisation principles by allowing data subjects to retain control of the disclosure of their personal data and thus limit the extent of that disclosure to what is necessary and relevant for the legitimate purpose: §52
• Thirdly, for the purposes of the balancing exercise, the referring court would have to particularly consider whether members of KNLTB could have reasonably expected that the data collected from them when becoming members of a tennis association that that data would be disclosed, for consideration, to third parties, in this case, the sponsors of KNLTB, for advertising and marking purposes: §55.
• Particularly, the referring court was to take into account that the provision of data by a tennis association to a provider of games of chance and casino cases for the purposes of promotional and marketing activities, although legitimate does not apparat to be characterised by a relevant and appropriate relationship between the data subjects and the controller: §56. That was especially the case where the processing of such data could have harmful effects on the members of the tennis associations concerned, as the activities advertised may expose the members to the risks associated with the development of gambling addiction.

Comment

On the one hand, while KNLTB was successful in establishing that a commercial interest may be a legitimate interest for the purposes of article 6(1)(f) provided that such an interest was not contrary to law, the ability to rely on such an interest is also restricted by the CJEU. In particular, the CJEU’s judgment suggests that where consent could be obtained to create a lawful basis under article 6(1)(a), then the second condition in article 6(1)(f), that is necessity, may not be satisfied. Further, where the commercial interest is solely obtaining an income or money, and there is no connection between the interest sought and the relationship between the data controller and the data subjects, then, when applying the third condition, article 6(1)(f) may not be satisfied. Thus, where a sports association is sharing data to a gambling company for advertising and promotional purposes, in determining whether the right balance has been struck, a court will need to consider the relationship between the association and its members, whether those members reasonably expected their data to be used in the way intended and what harm may arise from the disclosure and processing of their data.

About the author 

Jeremy Ogilvie-Harris is developing a practice in information and data protection law. Jeremy has particular experience of representing and advising benefits claimants and homelessness/housing register applicants who have been impacted by the digitisation of the social welfare sector.

Share this