January 27, 2021

Volume XI, Number 27

Advertisement

January 27, 2021

Subscribe to Latest Legal News and Analysis

January 26, 2021

Subscribe to Latest Legal News and Analysis

January 25, 2021

Subscribe to Latest Legal News and Analysis

Dutch Court Overturns DPA Fine on Legitimate Interest Legal Basis

On November 23, 2020, the Dutch District Court of Midden-Nederland (the “Court”) determined that the concept of a legitimate interest for processing is broader than simply being an interest derived from law, overturning a fine by the Dutch data protection authority (the “Dutch DPA”).

The Dutch DPA, Autoriteit Persoonsgegevens, issued a €575,000 fine in July 2020 against VoetbalTV, which allowed football players and fans to view professional video footage of amateur matches on its platform, on the basis that it lacked a legal basis for its processing of personal data, as required by Article 6(1) of the EU General Data Protection Regulation (“GDPR”). Thereby, VoetbalTV was also considered to have infringed GDPR Article 5(1)(a), which sets out the data protection principle that processing must be carried out lawfully.

Specifically, the Dutch DPA took a restrictive interpretation of legitimate interests that can be relied upon to legitimize the processing of personal data pursuant to Article 6(1)(f) of the GDPR. According to the Dutch DPA, a legitimate interest is one designated as a legal interest under law, and must have an “urgent and specific character” deriving from a rule or principle of law. According to the Dutch DPA, purely commercial interests do not constitute a legitimate interest that can serve as a legal basis for data processing activities under the GDPR.

In overturning the Dutch DPA’s decision, the court relied on guidance issued by the European Data Protection Board (the “EDPB”), which provides that legitimate interests can cover a range of different interests, provided that they are real and present (not speculative), meaning that all kinds of factual, economic and idealistic interests can qualify as legitimate interests.

The Court endorsed the position of VoetbalTV, which argued for a broad interpretation of the concept of a legitimate interest, stating that such an interest should be considered to be present unless the interest is contrary to the law (and provided that the interests or fundamental rights and freedoms of the data subject are not overriding). In doing so, the Court also relied on translations of the GDPR concepts of legitimate interest and legal obligation in Dutch, German and French, which indicate a clear distinction between the different legal bases for processing. The Court also considered this broad interpretation to be in line with Recital 47 of the GDPR, which provides that direct marketing may constitute a legitimate interest. The Court commented that the legitimate interest concept should be interpreted as an “an external border . . . and not as a threshold.”

The Court also determined that the Dutch DPA had not taken sufficient care in making its decision, as it stopped its investigation after determining that no legitimate interest existed, rather than considering the validity of the balancing test carried out by VoetbalTV.

Advertisement
Copyright © 2020, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume X, Number 336
Advertisement

TRENDING LEGAL ANALYSIS

Advertisement
Advertisement

About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct
Advertisement
Advertisement