Commercial interests as a GDPR legal basis : EU Court of Justice rules

On October 4 , 2024, the Court of Justice of the EU handed down an important ruling for the privacy and Data protection law in the EU.

ECJ 4 October 2024 (KNLTB/ Authority Personal data ) case C -162/22, ECLI:EU:C:2024:857

Can a commercial interest be a ' Legitimate interest '?

In short, the case before the ECJ concerned the question of whether a commercial interest can be a ' Legitimate interest ' within the meaning of the GDPR, on which processing of personal data can be based.

This judgment was eagerly awaited by experts in the field of privacy law throughout the EU, and also outside the EU. The outcome was in line with the expectations of these critical experts, which will be explained in this article in brief.

What happened?

In this case between the Royal Dutch Lawn Tennis Association (KNLTB) and the Dutch data protection authority “Autoriteit Persoonsgegevens”. The data protection authority had on 20 December 2019 issued a fine of €525,000 to the KNLTB. The “Autoriteit Persoonsgegevens” is the competent data protection authority for personal data in the Netherlands, which means it is the supervisor who monitors compliance with the General Regulation Data Protection Act (GDPR), colloquially called “the privacy law ” . The Authority Personal data found that the KNLTB had violated the GDPR by collecting personal data of KNLTB members provide to two sponsors for the direct marketing activities of those sponsors tennis enthusiasts .

The KNLTB did not agree with the criticism of the “Autoriteit Persoonsgegevens” regarding the sponsors. According to KNLTB the processing of personal data was lawful on the basis of 'Legitimate interests '.

The data protection authority swept the objections of the KNLTB off the table and referred to her own policy document regarding the interpretation of the legal concept of “Legitimate interest” within the meaning of the GDPR. In its “ Explanation of the Standards: ' Legitimate interest ” the data protection authority had -to the surprise of many experts in the field of privacy law-, included the following sentence :

“ What does not qualify  as a Legitimate interest would be, for example : the serving of purely commercial interests , profit maximization , monitoring the behavior of employees or the ( purchasing ) behavior of ( potential ) customers without legitimate interest , etc. ”

The interpretation that the data protection authority gave did not seem in line with the case law of the Court of Justice of the EU regarding that subject matter. In the famous Google Spain – case, many interpretation questions regarding the GDPR were answered. The Court of Justice of the EU in that case had said:

“81 Considering the potential seriousness of this interference it must be established that it cannot be legitimized solely by the commercial interest that the operator of such a search engine has regarding this processing. […].”

After all, from the consideration that this specific interference from the Google Spain case could “ not solely ” be legitimized by the commercial interest follows, -logically- that there are other – less drastic – interferences conceivable. Interferences which can be legitimized by a commercial interest whereby a different balancing of interests is at play, at least that is the prevailing consensus within the field of privacy and data protection law .

The KNLTB is contesting the fine in court and in that frame emerged this preliminary ruling decision of the Court of Justice of the EU regarding the question of whether the stunningly strict and narrow interpretation of the data protection authority in its policy standard about 'Legitimate interest ' is correct .

What was the case about?

From a legal perspective, the case concerned the question of whether a commercial interest can also fall under the umbrella of the residual category ' Legitimate interest ' of Article 6 paragraph 1 under f GDPR, or can never fall within that category . The answer to that question is essential for the application of the GDPR.

The data protection authority seemed to be of the opinion that an interest could only fall under the concept of 'Legitimate interest ' within the meaning of Article 6 paragraph 1 sub f GDPR, if the interest is identified beforehand in law as worthy of protection. According to the data protection authority could An interest only as Legitimate become accepted, if she first by the legislator as was considered worthy of protection. That is to say, the notions that a "positive test” of the legitimization of interests exists.

The KNLTB, on the other hand, interprets the GDPR based on the prevailing consensus. Namely that a “ Legitimate interest ” does not necessarily need to follow from a fundamental civil right, a legal principle, or the law. According to KNLTB, from the system of the GDPR that each interest can be a legitimate interest, provided that that interest is not against to the law. That is to say, that the question of whether a certain interest is legitimate has to be assessed on a case-by -case basis on the basis of a “ negative test ”, also based on the data facts and circumstances in that situation.

Article 6 paragraph 1 GDPR

With the exception of the special categories of personal data, for which a stricter legal regime applies, it is a main rule from the GDPR that personal data must be processed in a manner which towards the data subject is lawful, proper and transparent . The principle of lawfulness is one of the processing principles from the GDPR. All rules and obligations from the GDPR can be traced back to these basic principles.

In total does the GDPR recognize the following six legal bases on which personal data, excluding special categories of personal data, can be processed lawfully:

“ Article 6 paragraph 1 GDPR:
Processing shall be lawful only if and to the extent that at least one of the following applies:

1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
3. processing is necessary for compliance with a legal obligation to which the controller is subject;
4. processing is necessary in order to protect the vital interests of the data subject or of another natural person;
5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.

This list is exhaustive , that means that if a certain processing cannot be based on at least one of the above mentioned foundations, then the processing of personal data has been lawful within the meaning of the GDPR.

The GDPR is a very strict regulation . Does the processing comply not  this meets the requirements set by the GDPR processing for example unlawful been , then the result may be of them high fines or even liability claims are in connection with that breach of the GDPR.

Previously wrote an article regarding the legal basis of “ consent ”.

article Consent not suffice as grounds?

This article concerns a different basis , namely the basis “ Legitimate interest ".

How did the Court of Justice of the EU rule ?

The General Data Protection Regulation is an EU regulation. The Court of Justice of the EU (“CJEU”) in Luxembourg is highest court that has jurisdiction to answer questions regarding the interpretation of that Regulation. The clarity provided by this ruling of the Court of Justice of the EU is very important for practice. In this ruling, the Court of Justice of the EU ruled against the Dutch data protection authority regarding the General Regulation Data Protection (“GDPR”). The court ruled that the data protection authority’s extremely strict interpretation of the law is incorrect .

The Court of Justice of the EU ensures that the Dutch data protection authority “ Explanation of the Standard basis ' Legitimate importance ” which is much too strict and at narrow will be have to be adjusted, with the understanding that commercial interests can also be legitimate interests within the meaning of the GDPR.

The question whether the interests of KNLTB are Legitimate to be or not, must still be decided by the national court, based on the applicable testing framework. KNLTB could still lose after the weighing of interests by the judge, so the matter is not yet settled.

When can commercial interests be legitimate interests?

The Court of Justice of the EU emphasises that it had already indicated in the famous Google Spain case, CJEU 13 May 2014, (Google Spain and Google ), C ‑131/12, EU:C:2014:317, paragraph 73 that it had not excluded that an commercial interest , consisting in the promotion and sale of advertising space for marketing purposes , could be a legitimate interest. Experts who criticized the very strict standard interpretation of the Dutch data protection authority pointed at precisely that consideration from that 2014 ruling. The Court of Justice of the EU confirmed the prevailing consensus, a commercial interest can be a legitimate interest.

Of course the commercial interest has to be tested within the limits of applicable law and regulations and in relation to fundamental human rights . However, the Court of Justice gives no indication that in advance commercial interests should be considered differently than other kinds of interests by the court. The existing tests about the weighing of interests are still the same standard, and the interpretation of the Authority Personal data was incorrect .

The test criterion vis-a-vis an appeal to legitimate interests is:

1. There is a legitimate interest of the controller or of a third party
2. The processing of personal data is necessary for the pursuit of the legitimate interest
3. The interests or the fundamental freedoms and the fundamental rights of the data subject or involved natural person do not outweigh the legitimate interests of the controller or a third party
4. The processing principle of ' data minimization ' should also be applied, i.e. even​ if the processing is lawful on the above three criteria in the light of the principle of lawfulness, it is not allowed to process more personal data than necessary for the pursuit of the legitimate interest, in accordance with the data minimization principle

Also in the more recent ruling of the ECJ of 4 July 2023, (Meta Platforms et al. ( General terms of use of an online social network )), C ‑252/21, EU:C:2023:537, the same assessment standard was confirmed .

Is everything now allowed in direct marketing?

The ruling does not meant  that 'direct marketing' is now permitted in all cases , certainly not. For direct marketing strict legal rules apply under Dutch law, under the Dutch Telecommunications Act for which the Authority Consumer & Market (ACM) is the competent national authority. A violation of the legal rules regarding the conditions for the legality of direct marketing, could receive a fine or be subject to other administrative measures, or a liability claim from victims. It is certainly not permitted to send unsolicited on electronic communications, unless the standards set by law are followed.

The ruling of the Court of Justice of the EU holds yes in that the Dutch data protection authority is interpreted the GDPR incorrectly. The highest European court thus interceded. The rule of law holds that everyone is subject to the law, the same applies to regulators. If you are ever issued a fine or another measure is imposed by a competent authority, then you do not need to agree with that in all cases. Regulators also make errors. It is the court who ultimately may pass judgment on the interpretation of the law. Against a decision of a supervisor you can appeal, whether or not assisted by a lawyer. If the law is on your side you may be vindicated.

To ask ?

Are you wondering off what this ruling means for you or your organization? Do you have questions regarding privacy or data protection law ? Do you have questions about the do's and don'ts of direct marketing? Contact our Dutch IT & privacy lawyers . They will be happy to assist you.

Approach us for legal advice today!

Do you want to use our knowledge and call us with some regularity? Subscribe to the Virtual Legal Department. 

Interested? Call or email us:

T. +31(0)70-3819281
E. info@wisemen.nl

For the latest information, subscribe to the newsletter now

WiseMen Newsletter!