Netherlands Decision of the Council of State in VoetbalTV case fails to clarify whether the legitimate interest legal basis for processing is available for purely commercial interests

The RVS confirmed the lower court’s reversal of the fine imposed by the Dutch DPA, but unfortunately did not address the issue of whether purely commercial interests alone can qualify as a valid legitimate interest.

Background

The data processing by VoetbalTV, a collaboration between the Royal Dutch Football Association and Talpa Network that allowed fans to watch professional video footage of amateur football matches on VoetbalTV’s online platform, was based on legitimate interest. The Dutch DPA investigated Voetbal TV and imposed a fine of EUR 575,000 in 2019. In the enforcement action against VoetbalTV, the Dutch DPA took the position that a legitimate interest under the GDPR should represent an interest that is designated as a legal interest in legislation or otherwise by law, and it should be considered “worthy of protection” and have an “urgent” nature. 

In the opinion of the Dutch DPA, purely commercial interests and the maximisation of profits are not specific enough and lack an urgent 'legal' nature, and therefore cannot be qualified as legitimate interests, hence VoetbalTV violated the GDPR by processing personal data without a valid legal basis.

VoetbalTV argued that its interest in processing lies in (i) increasing the involvement and enjoyment of football fans, including that of the players captured on the video, (ii) enabling technical analytics by trainers and analysts of the football clubs and third parties, and (iii) offering the opportunity to players, friends and family members to be able to watch matches remotely. These arguments were rejected by the Dutch DPA and it imposed a fine. VoetbalTV challenged the Dutch DPA’s decision in court. 

Lower court decision

In November 2020, the District court Midden-Nederland disagreed with the Dutch DPA and ruled that, due to its rigid interpretation, the Dutch DPA did not properly evaluate whether VoetbalTV had applied the legitimate interest ground appropriately, annulling the Dutch DPA’s decision to impose the fine. The decision is available here (in Dutch).

The Dutch DPA appealed the court decision to the RVS. Among other things, the Dutch DPA asked the RVS to refer the question whether purely commercial interests of controller can qualify as a legitimate interest under Article 6(1)(f)GDPR.

RVS decision

The RVS confirmed the decision of the lower court and ruled that VoetbalTV did not need to pay the fine because the decision of the Dutch DPA was unfounded. The RVS ruled that the Dutch DPA was wrong not to consider whether VoetbalTV’s processing (filming football matches and making them available to third parties, including individuals who wanted to be filmed) would be necessary for also fulfilling other interests than purely commercial interests of VoetbalTV. The RVS also noted that it is up to the controller to determine what interest it has in the processing, why that processing is necessary to accomplish it and to act accordingly. The Dutch DPA, in its turn, should assess what the controller actually does, whether the intended interests are fulfilled by that activity and whether the processing is justified. The RVS confirmed the reasoning of the lower court that the Dutch DPA should have considered these aspects as well as taking into account other interests that were not purely commercial in nature. 

By wrongly not taking into account the interests asserted by VoetbalTV, the Dutch DPA erred in finding that VoetbalTV had acted in violation of Article 6(1)(f) GDPR. The RVS further concluded that it was not necessary to answer the question whether an exclusively commercial interest in itself can be a legitimate interest within the meaning of Article 6(1)(f) GDPR and to refer this question to the CJEU. 

Controversial legitimate interest guidance by Dutch DPA

The Dutch DPA also published, in November 2019, guidance on the interpretation of the legitimate interest (Normuitleg grondslag ‘gerechtvaardigd belang’, available here in Dutch), where it rejected purely commercial interests and profit maximisation of a controller as legitimate interests within the meaning of Article 6(1)(f) GDPR. The guidance stated that there is no legitimate interest when personal data are processed for (i) purely commercial interests, (ii) maximisation of profits, (iii) monitoring employee conduct without a legitimate reason, or (iv) tracking the (purchasing or otherwise) behavior of customers or potential customers.

In June 2022, Dutch and international mass media published leaked versions of the correspondence between the European Commission and the Dutch DPA, dated back to 2020, where the European Commission criticises the Dutch DPA’s stance on this topic. The EDPB has been working on updating the pre-GDPR guidance on the notion of legitimate interest, which is expected to clarify the common position of EU supervisory authorities on this topic. 

The press release of the RVS is available here and the decision here (both only in Dutch).