The Division rules that the DDPA imposed this administrative fine on incorrect grounds. The judgment of the Court of the Central Netherlands in first instance, in which that court annulled this administrative penalty, is therefore upheld. In this blog, we describe the course of the procedure, the status of the (DDPA's) Guidance regarding legitimate interest, European developments and the practical implications of this case.
What does VoetbalTV do and why did the DDPA impose the administrative fine?
VoetbalTV is a video platform for amateur football. This platform produces video footage of amateur football matches on behalf of football clubs. Through VoetbalTV football moments can be reviewed, matches can be analysed and data can be collected and shared with others. VoetbalTV is therefore also a social platform.
In July 2020, the DDPA imposed an administrative fine of EUR 575,000 on VoetbalTV, because of the alleged unlawful processing of personal data in the aforementioned activities. In short, the DDPA took the position that VoetbalTV is wrongfully processing personal data on the basis of a 'legitimate interest'. According to the DDPA the interest of VoetbalTV is not a 'legitimate interest' because this concerns a 'purely commercial interest' and not a 'legal interest'. According to the DDPA, only an interest that follows from a law would qualify as a legitimate interest. The main question in this procedure is therefore which interests can qualify as a 'legitimate interest'.
What happened in the proceedings?
In November 2020, the Court of the Central Netherlands ruled in first instance that the DDPA used an incorrect interpretation of the concept of 'legitimate interest'. The court saw no basis for the opinion that a 'legitimate interest' can only be a 'legal interest'. An assessment must be made as to whether the interest pursued conflicts with the law (a 'negative test'). If that is not the case, the interest can qualify as a legitimate interest. The DDPA should have assessed on the basis of the interests stated by VoetbalTV whether it was necessary to process personal data for these interests. Now that this did not happen and the DDPA did not discuss the necessity of the processing of personal data by VoetbalTV for the stated interests, the Court annulled the administrative penalty imposed by the DDPA.
What was the discussion in appeal?
In appeal, the DDPA again argued that a 'legitimate interest' is only an interest that follows from the law and that the Court misinterpreted this concept in its judgment in first instance. In doing so, the DDPA explicitly stated that the interest of VoetbalTV is purely commercial, that this is not an interest that follows from the law and for that reason should not be qualified as a 'legitimate interest'. By contrast, VoetbalTV stated that its interest is not purely commercial, but that VoetbalTV also (i) increases the involvement and enjoyment of football fans, (ii) ensures that technical analyses can be carried out (by trainers/analysts/third parties, amongst others), (iii) enables players, friends and family members to watch or review matches from a distance.
The Division ruled on the basis of the allegations that the interest of VoetbalTV is not only a purely commercial interest. The DDPA should have considered what VoetbalTV actually does, whether the interests put forward by VoetbalTV correspond with these interests, and also whether these interests are served thereby and whether these interests are legitimate. The Division therefore rules that the Court was right to annul the administrative fine in the first instance and that the question of whether a purely commercial interest could in itself be a 'legitimate interest' within the meaning of Article 6(1)(f) GDPR does not need to be answered.
The important unanswered question: the purely commercial interest
Unlike many other fines imposed by the DDPA, the DDPA did not publish its decision to impose an administrative fine on VoetbalTV. However, the DDPA did post its Guidance on 'legitimate interest' (Normuitleg, the Guidance) on its website on 1 November 2019, without specific announcement. In accordance with European case law, the Guidance sets out three conditions for using a legitimate interest as a lawful processing ground. Required are: (i) a 'legitimate interest', (ii) 'necessity' of the processing to fulfil that legitimate interest, and (iii) a balancing test against the fundamental rights and freedoms of the data subjects. According to the Guidance, 'purely commercial interests' and 'profit maximisation' would not qualify as legitimate interests. Consequently, for these interests it would not be relevant to assess whether the second and third condition are fulfilled. This is a very restrictive interpretation, which was also quickly recognised as deviating compared to interpretations of various other European privacy supervisory authorities.
The position of the DDPA became publicly known through the Guidance. As already apparent from the ruling of the Court of the Central Netherlands, the DDPA already applied its interpretation in the investigation into VoetbalTV before publication of the Guidance. The DDPA released its final investigation report on VoetbalTV on 6 November 2019, just five days after publication of the Guidance. In addition, the DDPA applied its restrictive interpretation to the administrative fine of EUR 525,000 to the Royal Dutch Lawn Tennis Association (KNLTB), as shown in the fine decision of 20 December 2019 published online by the DDPA on 3 March 2020.
The fact that the DDPA persisted in its own interpretation even after the ruling of the Court of the Central Netherlands follows from the fact that the Guidance has not been amended in the meantime. Possibly the DDPA awaited the judgment of the Division, or at least the answering of preliminary questions the DDPA asked the Division to submit to the Court of Justice. The Division did not consider this necessary for the adjudication of this case. However, the Division did confirm the ruling of the Court – which in our view should cause sufficient reason to now update the Guidance.
Various media have reported that the DDPA expressed great concern in a reaction, because this case involved tens of thousands of children who were filmed during leisure without having given their consent. It is remarkable that in its response, the DDPA mentions circumstances that would especially be relevant for the balancing test. Such balancing test could not be performed in this case, eminently due to the DDPA's interpretation.
What is happening in Europe?
There are a number of noteworthy developments concerning the concept of 'legitimate interest' also at the European level. On 3 July 2022, NRC (a Dutch newspaper) published a letter from the European Commission to the DDPA dated 6 March 2020 (three days after publication of the administrative fine imposed on the KNLTB). At that time, the EC already pointed out to the DDPA that the DDPA's interpretation was too strict, which risked hindering free enterprise in the EU. Shortly thereafter, the reaction of the DDPA was also published. The DDPA expressed its concern that the legitimate interest as a basis for processing data would be abused in the private sector by favouring companies in the required balancing tests. The publication in NRC led to questions for written answer to the EC from MEP Sophie in 't Veld on 26 July 2022, including what were the EC's grounds for intervention in this case, and whether there have been other interventions by the EC in connection with alleged misinterpretations of the GDPR.
As the GDPR is a European regulation, the GDPR standards must in principle be interpreted uniformly throughout the EU. To facilitate this, the European Data Protection Board (EDPB), a cooperation of the European privacy supervisory authorities, regularly publishes opinions and guidelines. For a considerable period, guidelines on legitimate interest have been on the agenda of the EDPB, but publication has been postponed several times. Perhaps the VoetbalTV judgment can contribute to a faster consensus between the European privacy supervisory authorities.
Going forward
A judgement of the Court of Justice about the specific question whether a purely commercial interest can be a legitimate interest is still waited for. The same seems to apply to an update of the Guidance of the DDPA and the EDPB Guidelines. In practice, an important take-away from the VoetbalTV judgment will be that it is not only about the question whether a purely commercial interest is a legitimate interest, but also (and especially) about the question whether that is the only legitimate interest for the processing. When multiple legitimate interests can be relied upon for processing, this reduces the likelihood of unlawfulness and therefore disruption of business continuity. Against this background, it is advisable, also with regard to existing processing operations, to assess whether they serve multiple interests, and whether all the applicable conditions and formalities are met.