VoetbalTV
VoetbalTV is a social media platform on which users can – in short – view and analyse Dutch amateur soccer matches, initiated by the Royal Dutch Football Association. VoetbalTV’s privacy statement shows that several safeguards are implemented to minimize privacy risk, including information notices on football clubs’ premises and the possibility to play on a field without cameras.
The Dutch SA imposed the now annulled fine on VoetbalTV in July 2020. Its arguments supporting the fine are similar to those we saw earlier when the Dutch SA imposed a fine on the Royal Dutch Tennis Association (KNLTB) – which we discussed in one of our previous blogposts.
In this blogpost, we discuss how the court’s legitimate interest interpretation differs from that of the Dutch SA and what its ruling might mean for companies relying on this legal basis for processing personal data. Interesting from an EU perspective is that the EU supervisory authorities together need to take a decision on a pan-EU legitimate interest interpretation soon, in view of the expected legitimate interest guidance of the EDPB. Although the Dutch SA could still appeal the court’s ruling, it will be interesting to see how its interpretation in the Netherlands and on EU level is impacted at this stage.
The current Dutch SA’s legitimate interest interpretation
Unfortunately, the full investigation report and fining decision are not disclosed to the public. However, a summary of the Dutch SA’s interpretation in the court ruling seems to be in line with its guidance note published in November 2019 and its fining decision in the KNLTB case. The Dutch SA consistently argues that a legitimate interest should:
- “be designated as a legal interest in the law”;
- “be respected and enforced”;
- “have a more or less urgent and specific character arising from a rule of law or principle of law (written or unwritten)”; and
- “be inevitable, in the sense that organizations pursue the interest in any event.”.
More specifically, the Dutch SA argues in the KNLTB case that the two interests below do not meet these requirements:
- adding value to tennis players’ membership; and
- reducing income loss due to a declining amount of members.
In its 2019 guidance note, the Dutch SA furthermore excludes solely commercial interests and the interests of profit maximization and monetizing personal data. It seems to apply these exclusions broadly. Whilst VoetbalTV indicates that it has interests that go beyond commercial purposes, i.e. (i) increasing the amusement and involvement of football players, (ii) performing technical analyses by trainers and analysts and (iii) offering the possibility to players, friends and family members to watch matches online, the Dutch SA solely focusses on the fact that VoetbalTV ultimately has a commercial goal, which in view of the Dutch SA can never be a legitimate interest.
“The core of [VoetbalTV’s] activities consists of the processing of personal data and with that processing, [VoetbalTV’s] earns money. [VoetbalTV’s] therefore has a solely commercial interest in the processing of personal data. According to the [Dutch SA], this can never be a legitimate interest.”
The Dutch court’s ruling and legitimate interest interpretation
The court annulled the decision to impose the fine on VoetbalTV (in relevant part) on the basis that the Dutch SA applied a wrong interpretation of legitimate interest to serve as a legal basis for processing personal data. That interpretation could not justify the Dutch SA’s conclusion that VoetbalTV’s interests are not legitimate.
The court did not assess itself whether VoetbalTV’s interests in fact are legitimate. Although such interest specific analysis could have brought further clarification, the court already described its legitimate interest interpretation quite extensively. Below are its main considerations:
- “CJEU case law does not seem to indicate that the interest should be a legal interest.”;
- “Translations of the separate GDPR concepts of legitimate interests and legal obligations point out that the legislator did not mean to interpret legitimate as legal.”;
- “Not only legal, but all kinds of factual, economic and idealistic interests can qualify as legitimate interests.”;
- “The interest of direct marketing, mentioned in recital 47 GDPR as a potential legitimate interest, could not be regarded as such in view of the Dutch SA, as this interest is not a legal interest.”; and
- “It is prohibited to exclude an interest as a legitimate interest, as long as it is not illegal.”
This interpretation allows for more interests than the Dutch SA’s interpretation, as many factual, economic, and idealistic interests are not designated in the law. In addition to the interest of direct marketing mentioned by the court, it could be argued that this is also true for KNLTB’s and VoetbalTV’s interests mentioned above.
Procedural considerations
The court ruling furthermore includes two interesting procedural considerations, about how the Dutch SA should have assessed VoetbalTV’s interests.
Firstly, the court rules that it is – in principle – up to controllers (i.e., VoetbalTV) to determine their legitimate interests. The Dutch SA should make an assessment of these interests, instead of starting its analysis based on its own notion of what the controller’s legitimate interests are. We tend to agree that the Dutch SA’s approach of solely focusing on the fact that VoetbalTV ultimately has a commercial goal and then establishing non-compliance (as described above) does not seem to be a fairly balanced assessment.
Secondly, the court ruled that a legitimate interest assessment should always include analyzing the necessity of the processing operation and balancing the controller’s interests against the rights and freedoms of the data subjects (natural persons involved). This consideration is a response to the Dutch SA’s argument that these elements would be meaningless if an interest is not legitimate from the outset.
In sum, the court requires the Dutch SA to apply a more flexible legitimate interest interpretation and perform a more comprehensive assessment of all interests involved. Upcoming developments, including the expected European Data Protection Board (EDPB) guidance and the Dutch SA’s potential appeal, will show whether this court ruling means the end of the Dutch SA’s strict legitimate interest interpretation. We will provide further updates on this blog.
Authored by Joke Bodewits and Wout Olieslagers.
