CJEU asked to define scope of GDPR ‘legitimate interests’

The Court of Justice of the EU (CJEU) has been asked to rule on whether a purely commercial interest can be regarded as a ‘legitimate interest’ for the purposes of the General Data Protection Regulation (GDPR) and, if so, to outline the circumstances which will determine that.

The reference to the CJEU has been made by a district court in Amsterdam in the context of an underlying dispute between the Dutch data protection authority (DPA) and a sports association, but the answers the CJEU provides could have a much broader impact and will be keenly anticipated by organisations globally.

The GDPR sets out six lawful bases for processing personal data. Perhaps the most obvious basis for processing personal data, under the legislation, is consent. However, processing of personal data can be undertaken without consent if one of the other five legal bases can be relied upon, including if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party.

The ‘legitimate interests’ ground can only be relied upon for processing personal data if the interests cited by the controller are not “overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data […]”.

The legitimate interest ground is relevant in a decision of the Autoriteit Persoonsgegevens (the AP, the Dutch DPA) in 2019 where it imposed a fine of €525,000 against the Royal Lawn Tennis Federation (KNLT), an affiliation body for tennis clubs and its members. KNLT had shared the data of some of its association members with sponsors in return for payment, and the sponsors subsequently used the data for promotional campaigns through mailshots and telemarketing. The Dutch DPA considered that the data had been shared unlawfully and in 2020 rejected an appeal KNLT had raised against its original decision.

KNLT has raised a subsequent appeal before the district court in Amsterdam, claiming that its data sharing was not unlawful because it had a lawful basis for sharing the data – legitimate interests. The crux of its argument is that a legitimate interest exists unless that interest is contrary to law. However, that interpretation of the law is challenged by the Dutch DPA, which considers that there must be a legitimate and therefore concrete interest pertaining to the law, constituting law, enshrined in a law, for it to constitute a legitimate interest for the purposes of the GDPR.

The Amsterdam court considers that it cannot answer whether the KNLT had a legitimate interest in processing the personal data the way it did in this case beyond reasonable doubt, and so has asked the CJEU for its help in interpreting EU law. A working document (5-page / 186KB PDF) published by the CJEU sets out arguments, as considered by the Amsterdam court, on both sides of the debate. Case law of the CJEU, including its ruling in the so-called Fashion ID case, is cited as potentially relevant.

Amsterdam-based data law expert Andre Walter of Pinsent Masons said he welcomes this development since the position of the AP with respect to the scope of legitimate consent ground has attracted broad criticism and seems to deviate from the views of data protection authorities in other EU countries.

It typically takes several months, and often more than a year, for a case referred to the CJEU to be ruled upon by the court. In some cases, a legal adviser to the CJEU – known as an advocate general – issues a non-binding opinion to provide guidance to the CJEU judges on how EU law should be interpreted in the case. These opinions are usually published a few months prior to the formal ruling. The CJEU is not bound to follow the opinion of the advocates general when it comes to issuing its judgment.

That said, it is also normal for cases to first go through appeal to the national High Court and subsequently the Supreme Court in EU countries, and as a result the typical timeline to get an issue decided upon by the CJEU is one of many years.

Amsterdam-based data law expert Wouter Seinen of Pinsent Masons said it is exceptional for a district court to make a direct referral to the CJEU – usually cases pass through various courts of increasingly seniority in EU member states before issues are referred to the CJEU for help interpreting EU law.

“This bold decision of the district court is likely driven by the impact of this matter of interpretation for other businesses and individuals,” said Seinen. “It is in the interest of society at large to bring legal certainty.”

In July 2022 the European Commission voiced its concerns regarding the AP’s restrictive interpretation of the legitimate interest ground; in the Dutch parliament, questions were raised as to why this letter was not shared with the Dutch government.