The ruling of the Dutch court
In its decision of 6 August 2024, the Dutch district court ruled that it cannot be excluded in advance that the position taken by the Dutch DPA in sanction decisions regarding legitimate interests will not stand in court. The court bases this ruling on the fact that preliminary questions are pending before the Court of Justice of the European Union (CJEU) about the interpretation of the “legitimate interest” term. With its judgement (C-621/22) expected in two weeks, on 4 October 2024, the CJEU will hopefully provide clear guidance that purely commercial interests may not categorically be excluded from qualifying as legitimate interests. With this ruling, the Dutch court appears to be anticipating the CJEU’s confirmation of the fact that the Dutch DPA applies a too strict, commerce hampering interpretation of Article 6(1)(f) GDPR.
Why the Dutch DPA’s interpretation is too strict
Recital 47 of the GDPR explicitly states that direct marketing (i.e., a commercial interest) may constitute a legitimate interest. This recital also underlines that the existence of a legitimate interest requires a careful assessment, including whether the data subject could reasonably expect the data processing. In a commercial context, it is not difficult to argue that data processing based on purely commercial interests could be reasonably expected by data subjects if transparency obligations are met.
Moreover, we note that there already is CJEU case law on Article 6(1)(f) GDPR available. In CJEU Fashion ID, for instance, it was reiterated that the legitimate interest test consists of three cumulative criteria: i) the interests pursued are “legitimate”, ii) the processing of personal data concerned is necessary for the legitimate interests pursued, and iii) fundamental rights and freedoms of the data subject do not take precedence. Whereas the Dutch DPA takes the view that purely commercial interests already fail the first criterium, it was underlined in CJEU SCHUFA Holding that a wide range of interests is, in principle, capable of being regarded as legitimate. From CJEU Breyer even follows that, in the context of the legitimate interest test, Member States may not, categorically and in general, exclude the possibility of processing certain categories of personal data without allowing the opposing rights and interests at issue to be balanced against each other in a particular case.
Given that the freedom to conduct a business is a fundamental right enshrined in the Charter of Fundamental Rights of the European Union, purely commercial interests should be regarded as “legitimate”. This should allow for assessment of the last two criteria in the legitimate interest test, which we believe could be passed by purely commercial interests, dependent on the particular case.
In anticipation of 4 October
In addition to the abovementioned case law, the European Commission openly criticized the Dutch DPA’s interpretation in 2022, considering that categorically excluding commercial interests as potential legitimate interests undermines the fundamental freedom to conduct a business (as can be read in our previous blog here). However, as follows from the recent case, the Dutch DPA did not change its approach. It is now for the CJEU to clear the air, with its judgement expected to be released on 4 October. Meanwhile, the fact that no AG Opinion will be issued in this CJEU case appears to be an indicator that the CJEU does not view the interpretation of the “legitimate interest” term to concern a complex and/or new point of law either.
Authored by Joke Bodewits and Isabella Noija.
