VoetbalTV’s ‘legitimate interests’ Dutch data fine overturned, but questions remain (update*)

A controversial data protection fine against a Dutch football television channel has been overturned — but wider questions about the interpretation of the General Data Protection Regulation’s “legitimate interests” rule have been left unanswered.

The Dutch Council of State, the country’s highest administrative court, ruled today that VoetbalTV does not have to pay a fine of 575,000 euros ($583,000) levied by the Dutch Data Protection Authority in 2020.

The case has attracted attention because the regulator’s original decision said that VoetbalTV, which live-streams football matches, could not use the GDPR’s “legitimate interests” legal basis to process data if it was doing so for purely commercial purposes.

That interpretation of the legitimate interests legal basis ⁠— which does not require permission for organizations to process data and is one of the most commonly used of the six provided for by the GDPR ⁠— is in line with guidance issued by the regulator.

Critics have argued that blocking the use of the legitimate interests legal basis for commercial purposes harms privacy and makes life harder for companies because it forces them to obtain consent instead.

Some privacy campaigners argue that companies can often get away with more invasive data processing when they rely on consent than when they use legitimate interests, because less due diligence is involved.

The European Commission also stepped in, arguing that the interpretation is not in line with the GDPR, with guidelines from the European Data Protection Board — the umbrella body of EU data protection authorities — or with the case law of the EU Court of Justice. The regulator disputed that position.

However, the court ruling today declined to comment on whether purely commercial interests can count as a legitimate interest under the GDPR. It said that the regulator had failed to properly consider VoetbalTV’s other non-commercial interests, which it cited when deciding whether it could process data.

“In view of the other interests mentioned by VoetbalTV, which are not of a commercial nature, there is no question of a purely commercial interest,” the ruling said.** “There is, therefore, no need to answer the question whether an exclusively commercial interest in itself can be a legitimate interest.”

The ruling means the interpretation of legitimate interests, which could fundamentally affect how thousands of businesses process data, remains open. The European Data Protection Board is due to release updated guidance on the issue, though when this will arrive isn't yet clear.

The court decision today follows a ruling by a lower court which also overturned the fine.

A spokesperson for the Dutch data watchdog acknowledged that the court found its position to be “technically and legally incorrect,” but said that companies cannot now automatically rely on legitimate interests to justify an invasion of privacy. The spokesperson said the case was of concern because it involved thousands of children being filmed and broadcast without permission.

The regulator will now study the ruling and decide what action to take next, the spokesperson said, but stressed that under the GDPR, a legitimate interest must always outweigh any invasion of privacy involved in the activity, and that the authority is still free to fine companies if necessary.

* Updated on Jul. 27, 2022 at 11:25 GMT: Adds response from Dutch Data Protection Authority
** MLex translation from the original Dutch