Coolblue B.V. – Court Ruling (Netherlands, 2021)

Controller is Coolblue B.V., a company that sells (electronic) products. Data subject was employed at Coolblue between 8 August 2017 and 7 August 2020. During that time, with data the subject’s permission, Coolblue took photographs of the data subject in the context of promotion/marketing. Pictures of data subject were seen on approximately hundred Coolblue-vans, and they also featured in a promotional video on Coolbue’s YouTube channel. After the termination of the contract, data subject, among other things, claimed that Coolbue should (again) have requested data subject’s consent for the use of the promotional material, since it contained their personal data. According to the data subject, Coolblue had no legal basis to process their personal data, since data subject revoked their consent on the 20th of November 2020, pursuant to Article 7(3) GDPR. The Rotterdam Court of First Instance rejected data subject’s claim that Coolblue had no legal basis to process their personal data. First, it considered that the use of data subject’s pictures and video’s falls within the material scope of the GDPR, since personal data is being processed. It noted that data subject revoked their consent pursuant to Article 7(3) GDPR, and Coolblue could therefore not rely on Article 6(1)(a) GDPR as a legal basis for the processing of data subject’s personal data. However, the Court stated that, although Coolblue could not rely on the data subject’s consent, it could rely on Article 6(1)(f) GDPR, if their legitimate interest to process the personal data override the data subject’s fundamental rights and freedoms do not override the legitimate interest of Coolbue. In that regard, the Court noted that Coolblue had a commercial interest, that this interest is legitimate, and that the costs for Coolblue would be unreasonably high, and the impact on their business enormous, if the photograph of data subject could no longer be used. Moreover, Coolblue also accommodated data subject’s inte