The Dutch court docket is legally overturning the information safety authority’s positive
On November 23, 2020, the Dutch District Court of Midden-Nederland (the “Court”) found that the concept of a legitimate interest in processing is broader than just an interest derived from the law that cancels a fine from the Dutch Data Protection Authority (the “Dutch Data Protection Authority”) ).
The Dutch data protection authority Autoriteit Persoonsgegevens imposed a fine of 575,000 euros on VoetbalTV in July 2020, which allowed football players and fans to view professional video material of amateur games on their platform, as they lacked a legal basis for the processing of personal data in accordance with Article 6 (1) of the General Data Protection Regulation of the EU (“GDPR”). It was also assumed that VoetbalTV has violated Article 5 Paragraph 1 Letter a of the GDPR, in which the data protection principle is stipulated that the processing must be lawful.
In particular, the Dutch Data Protection Authority has implemented a restrictive interpretation of legitimate interests on which the legitimation of the processing of personal data in accordance with Article 6 (1) (f) of the GDPR can be based. According to the Dutch Data Protection Authority, a legitimate interest is an interest legally defined as a legal interest and must be of “urgent and specific character” resulting from a rule or legal principle. According to the Dutch data protection authority, purely commercial interests do not constitute a legitimate interest that can serve as a legal basis for data processing activities within the framework of the GDPR.
In setting aside the Dutch Data Protection Authority’s decision, the court relied on guidelines from the European Data Protection Board (“EDPB”) that legitimate interests can cover a range of different interests, provided they are real and present (not speculative). This means that all kinds of factual, economic and idealistic interests can be considered legitimate interests.
The Court endorsed VoetbalTV’s position, which advocated a broad interpretation of the concept of a legitimate interest, stating that such an interest should be considered to exist unless the interest violated the law (and provided that the interests or fundamental rights and freedoms of the data subject do not have priority). In doing so, the Court also relied on translations of the GDPR concepts of legitimate interest and legal obligation into Dutch, German and French, which indicate a clear distinction between the different legal bases for processing. We also found this broad interpretation to be in line with recital 47 of the GDPR, which provides that direct marketing can be a legitimate interest. We found that the concept of legitimate interest should be interpreted as an “external border”. . . and not as a threshold. “
The Court also found that the Dutch Data Protection Authority had not made its decision with sufficient care as it closed its investigation after finding that there was no legitimate interest instead of examining the validity of the balancing test carried out by VoetbalTV.