Coolblue B.V. – Court Ruling (Netherlands, 2021)
General GDPR enforcement action
This case relates to broader data protection obligations, not specifically to cookie or consent banner compliance. It is not included in cookie statistics or the Risk Calculator.
A former employee of Coolblue claimed the company used their photos without proper consent after they left the job. The court found that Coolblue had a legitimate interest in using the photos for marketing, even after the employee withdrew consent. This ruling shows that companies might still use personal data if they have a strong business reason.
What happened
Coolblue continued using a former employee's photos for marketing after the employee withdrew consent.
Who was affected
The former employee whose photos were used on Coolblue's promotional materials.
What the authority found
The Rotterdam Court ruled that Coolblue could rely on legitimate interest to use the photos, even after consent was withdrawn.
Why this matters
This case highlights that businesses can sometimes use personal data based on legitimate interests, even if consent is withdrawn. Companies should assess their legal bases for data use carefully.
GDPR Articles Cited
Controller is Coolblue B.V., a company that sells (electronic) products. Data subject was employed at Coolblue between 8 August 2017 and 7 August 2020. During that time, with data the subject’s permission, Coolblue took photographs of the data subject in the context of promotion/marketing. Pictures of data subject were seen on approximately hundred Coolblue-vans, and they also featured in a promotional video on Coolbue’s YouTube channel. After the termination of the contract, data subject, among other things, claimed that Coolbue should (again) have requested data subject’s consent for the use of the promotional material, since it contained their personal data. According to the data subject, Coolblue had no legal basis to process their personal data, since data subject revoked their consent on the 20th of November 2020, pursuant to Article 7(3) GDPR. The Rotterdam Court of First Instance rejected data subject’s claim that Coolblue had no legal basis to process their personal data. First, it considered that the use of data subject’s pictures and video’s falls within the material scope of the GDPR, since personal data is being processed. It noted that data subject revoked their consent pursuant to Article 7(3) GDPR, and Coolblue could therefore not rely on Article 6(1)(a) GDPR as a legal basis for the processing of data subject’s personal data. However, the Court stated that, although Coolblue could not rely on the data subject’s consent, it could rely on Article 6(1)(f) GDPR, if their legitimate interest to process the personal data override the data subject’s fundamental rights and freedoms do not override the legitimate interest of Coolbue. In that regard, the Court noted that Coolblue had a commercial interest, that this interest is legitimate, and that the costs for Coolblue would be unreasonably high, and the impact on their business enormous, if the photograph of data subject could no longer be used. Moreover, Coolblue also accommodated data subject’s inte
Outcome
Court Ruling
A ruling by a national court on a data-protection matter.
Related Cases (0)
No other cases found for Coolblue B.V. in NL
This is the only recorded case for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. Coolblue B.V. - Netherlands (2021). Retrieved from cookiefines.eu
Last updated: