Dutch Court closes VoetbalTV case, but balance to the GDPR Legitimate Interest is yet to be restored

Yesterday, the Dutch Administrative Jurisdiction Division of the Council of State (RvS) published its judgment in the VoetbalTV v Dutch Data Protection Authority (DPA)case. In its ruling, the Dutch Highest Court rejected the appeal of the DPA which had imposed a €575,000 fine on VoetbalTV for “unlawfully” relying on the legitimate interest ground in article 6(1)(f) GDPR to process personal data for purely commercial purposes by broadcasting amateur football through camera systems installed along the fields which were therefore filming people. The fine had already been canceled by the Court of First Instance in 2020 after VoetbalTV launched a court proceeding against the Dutch DPA.

The central question in this case was what exactly constitutes a legitimate interest and under what conditions the processing of personal data for that purpose is lawful. The RvS ruled that it is up to the organization that processes the personal data to indicate what its interests are and why the processing of that data is necessary for this. It is then up to the DPA to assess the actual activities of the data controller, whether these interests correspond to the stated interests and whether those interests are served by the data processing and whether those interests are justified.

According to RvS, the Dutch DPA did not correctly assess all interests that VoetbalTV had put forward, thus missing that VoetbalTV did not only have a strictly commercial interest in making images of football matches. Therefore, the fine was wrongly imposed.

In doing so, however, the Dutch Highest Court did not address the question whether a purely commercial interest can constitute as a legitimate interest (under the first step of the three-step test) as it ruled that VoetbalTV did not base its processing on a strictly commercial interest. As such, despite the positive outcome for VoetbalTV, one cannot help feeling slightly disappointed for the missed opportunity to settle such a key question, especially in the Netherlands where the national DPA has been extremely vocal in holding that purely commercial interests can never amount to a legitimate interest under Article 6(1)(f) GDPR.

FEDMA has always advocated for a harmonized and balanced interpretation of the GDPR with accountability as its core pillar. In line with Recital 47 of the GDPR, we believe in the accountable use of Legitimate Interest for marketing purposes. Requiring a demonstrable Legitimate Interest Assessment (LIA), this GDPR legal ground does not give an unconditional right to process data and it is not an easier legal basis than consent. The strict (re)interpretation of the GDPR by some DPAs does not only feed legal fragmentation across the EU, but it also constitutes a serious obstacle for the free movement of data across the Digital “Single” Market, hampering both individuals and businesses.

Taking also into account that the RvS decided not to refer the case to the Court of Justice of the European Union (CJEU), the Dutch DPA’s strict interpretation on the use of Legitimate Interest for commercial purposes remains unchallenged. It is becoming nevertheless clear that such question, along with the tendency of DPAs across the EU to adopt fragmented interpretations of the GPDR, is increasingly creating institutional tensions. This was indeed reflected in a letter exchange between the European Commission and the Dutch DPA where European institution criticized the latter for its strict interpretation of legitimate interest under the GDPR, claiming that it was in conflict with the Regulation and CJEU’s case law while also hampering businesses’ activities.

However, given the unmoving stance by the Dutch DPA and in the absence of a case referred to the CJEU, we can only hope for the European Data Protection Board (EDPB) to come up with a common position to settle the question and restore balance to the GDPR.

You can find here the judgment (in Dutch) here