Do controllers always have to ask for the consent of their clients to transmit their personal data to sponsors for advertising purposes? Can such an interest be regarded as legitimate interest in the sense of the GDPR? Or a legitimate interest can only be an interest that is defined by law? The CJEU has addressed these issues in the case of a tennis federation, which we analyse in this short article.
Smartlegal Schmidt&Partners reports from Hungary:
- Facts
KNLTB is a sport federation, its members are tennis players. The sport federation co-operates with sponsors such as a sports products seller and the largest provider of games of chance and casino games.
Certain members complained that KNLTB disclosed their personal data to the above sponsors for marketing purposes without their consent or any other legal basis. The Dutch Data Protection Authority (“DPA”) established that by doing so KNLTB infringed the GDPR[i] and imposed a fine of ca. EUR 500.000.
KNLTB brought an action against the decision of the DPA before the Amsterdam District Court claiming that the basis of the disclosure of the personal data was his legitimate interest.
- Procedure in the Netherlands
As his legitimate interest the KNLTB identified the following: to create a strong link between the association and its members and to be able to provide added value to the membership in the form of discounts and offers from sponsors enabling the members to play tennis at an affordable and accessible price.
According to the DPA such interests cannot be considered as legitimate interest in the sense of Article 6 (1) (f) of the GDPR. The DPA claims that legitimate interest may only be that are enshrined in and determined by the law.
The Amsterdam District Court stayed the proceedings and referred the case to the Court of Justice of the European Union in order to interpret Article 6 (1) (f) of the GDPR.
- Question to the CJEU
Basically, the referring court asked the CJEU whether Article 6 (1) (f) of the GDPR must be interpreted narrowly meaning that it requires that a legitimate interest be determined by the law or the commercial interest of the controller or a third party may be regarded as a legitimate interest.
- A commercial interest might be legitimate interest
The Luxembourg Court reminded that Article 6 (1) (f) of the GDPR lays down three cumulative conditions so that the processing of personal data is lawful:
- the pursuit of the legitimate interest by the controller or a third party,
- the need to process personal data for the pursued interest and
- the interests or fundamental freedoms of the data subject do not take precedence over the pursued legitimate interest[ii].
When it comes to what can be legitimate interest, the GDPR does not require that the interest pursued by the controller be provided for by the law. For example, recital 47 of the GDPR cites direct marketing purposes in general as an example of legitimate interests that may be pursued by a controller.
To sum up, legitimate interest within the meaning of Article 6 (1) (f) of the GDPR are not limited to interests enshrined in and determined by law, however the alleged legitimate interest shall be lawful.
In certain cases, a purely commercial interest, such as the one in question, may be regarded as legitimate interest.
- Legitimate interest – necessity and balancing test
As mentioned above, for the data processing to be lawful based on Article 6 (1) (f) of the GDPR the pursued interest shall not only be legitimate, but the processing shall also be necessary, and the legitimate interest cannot be overridden by the rights and freedoms of the data subject.
When it comes to the necessity, the processing can only be regarded as necessary if the pursued legitimate interest cannot be achieved by other, less restrictive means. In this case, KNLTB could have informed its members beforehand and asked them whether they want their data to be transmitted to the sponsors for advertising or marketing purposes.
As regards to the balancing between the legitimate interest and the rights and freedoms of the data subject, particular importance shall be attached to the question whether the members of the KNLTB could reasonably expect at the time of disclosing their personal data to the sport federation, that this data would be transmitted to the sponsors of the KNLTB for advertising and direct marketing purposes. Further, it may also be relevant that the disclosure of data to a provider of games of chance and casino games could even have negative effects on the data subjects (e.g. the risk to develop gambling addiction).
- Comment
As it can be seen from the CJEU’s judgement, a purely commercial interest may be regarded as legitimate under the GDPR, and it is not necessary that such an interest is determined by the law. However, for the data processing to be lawful, other conditions shall be met. Namely, the processing shall be necessary, and the rights and freedoms of the data subject cannot override the pursued legitimate interest.
In this article we analysed the judgement C‑621/22 of the CJEU.
Written by Anita Vereb
SMARTLEGAL is a team of agile business & litigation lawyers in Budapest, Hungary, helping international corporate clients and individual entrepreneurs doing business in Hungary. For more information please visit our website at smartlegal.hu
[i] REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
[ii] see 4 July 2023, Meta Platforms and Others (General terms of use of a social network), C‑252/21, EU:C:2023:537
Keywords: European Union, CJEU, Data protection