Judge rightly whistles back Personal Data Authority

Some time ago I blogged that the Personal Data Authority (AP) takes an overly strict stance against companies that collect personal data of data subjects for commercial purposes. This is because the AP takes the position that purely commercial interests and profit maximization are not grounds for processing personal data. However, this is at odds with previous European Court rulings. Nor is the AP's position reflected in the text of the General Data Protection Regulation (AVG). In fact, the AVG does offer room to process personal data for commercial purposes.

Last Monday, the Central Netherlands District Court finally made short shrift of this position of the AP. So good news for (commercial) companies in our country and reason to write a blog about it.

AP position: purely commercial interests and profit maximization a 'no go'

The AVG provides that personal data may only be processed when there is a legal basis for doing so. One such basis is the so-called legitimate interest of the organization that wants to process the personal data. In other words; an interest of the organization for which certain personal data must necessarily be processed. As examples, the AP mentions the protection of privacy, combating fraud (theft) and fulfilling duties of care. In that context, the AP believes that merely serving a purely commercial interest and profit maximization explicitly do not qualify as a legitimate interest to process personal data.

That position of the AP is highly controversial. First of all, this interpretation is contrary to the AVG, which does not provide a definition or enumeration for the concept of legitimate interest. The organization can therefore define that interest itself, as long as the processing of personal data is truly necessary to serve that interest, that interest cannot be served in a less intrusive way, and the interests of the data subjects are not disproportionately harmed by it (balancing of interests). Reason the AP's explanation is not in line with that of other European regulators. They believe that it is permitted to process personal data for commercial purposes.

Furthermore, the AP's position is contrary to various European case law, which has held that certain economic interests (such as advertising) can qualify as legitimate interest. The ECJ has also repeatedly held that member states are not free to exclude in advance reliance on legitimate interest for certain categories of processing.

Lastly, this position poses a problem especially in practice for (commercial) companies. They run up against the fact that they cannot invoke the commercial interest for a processing of personal data, which makes it more difficult to carry out marketing activities and possibly inhibits the development and usability of products and services.

Despite the many criticisms and (legal) arguments against its position, the AP has not changed its position to date. Meanwhile, the Central Netherlands District Court has issued a ruling that will hopefully change this.

hefty fine FootballTV

VoetbalTV is a company that since 2018 has installed cameras at about 150 amateur soccer clubs in the Netherlands that fully automatically record and record soccer matches. FootballTV then broadcasts this footage via its app. The AP has repeatedly raised objections to this practice, particularly because recordings are also made and broadcast from underage soccer players. According to the AP, this processing is based on a purely commercial interest, which is not allowed. As a result, according to the AP, there is a large-scale privacy violation and it has imposed an administrative fine of €575,000 on FootballTV.

Is the fine justified?

FootballTV appealed this fine (first objecting and then appealing) to the court, arguing that it was processing footage of soccer matches because of (among other things) a commercial interest. According to VoetbalTV, this is allowed under the AVG and the AP wrongly imposed a fine on it. The AP defends itself against this with its controversial position that a purely commercial interest cannot be a legitimate interest and that by processing the footage, FootballTV has ensured a large-scale privacy violation.

The court makes short shrift of this - fortunately - and considers that the AP's strict application of the legitimate interest "does not interpret it in an open and flexible manner, as it should." The court concludes that excluding certain interests in advance - as the AP does - is contrary to ECJ case law. In the court's opinion, the AP should have conducted an investigation into the interests of FootballTV and then weighed those interests against the interests of the data subjects. Having failed to do so, the appeal is well-founded and the decision, in which the fine was given, is set aside.

Commercial interest yes ground for processing

The court's ruling means that the AP's strict interpretation is indeed not in line with the AVG. This provides good news for many business owners ; they are therefore allowed to base their commercial interest on the processing of personal data[1]. To be fair, we have also just recently been advising our clients positively about processing personal data for commercial purposes, despite the AP's position. But this ruling really means "green light.

Whether and in what way the AP will change its standard explanation of legitimate interest remains to be seen. I am curious!

Curious about the full ruling? Then click here.
Do you have questions about processing personal data for commercial purposes? If so, please feel free to contact us.

[1] Of course, the processing must then be genuinely necessary, there must be no less intrusive option, and the processing must not be unreasonably burdensome to data subjects.