VoetbalTV – Court Ruling (Netherlands, 2022)

VoetbalTV (the controller) is a collaboration between the Royal Dutch Football Association and Talpa Network. The online platform allowed fans to (re)watch and analyze professional video footage of football matches played by amateur players (the data subjects). VoetbalTV based its processing activities on a legitimate interest. = The Dutch DPA investigated Voetbal TV in 2019 and imposed a fine of €575.000 for processing personal data without a legal basis. The DPA held that VoetbalTV had a purely commercial interest, which can never be legitimate interest pursuant to Article 6(1)(f) GDPR. The DPA followed that a legitimate interest should (1) stem from a legal provision, (2) be worthy of protection and (3) have an urgent nature. According to the DPA, a purely commercial interests was not specific enough and lacked an urgent legal nature. VoetbalTV appealed this decision at the District Court. = The court found that the DPA gave a wrong interpretation of legitimate interest. It noted that having a purely commercial interest does not exclude a legitimate interest. The further held that the DPA did not sufficiently substantiate its decision. It should have investigated all the interests of VoetbalTV and weigh them against the violation of the privacy of those involved. Therefore, the Court held that the DPA should not have issued the fine and annulled the decision (see: [https://gdprhub.eu/index.php?title=Rb._Midden-Nederland_-_UTR_20/2315 UTR 20/2315]). The DPA appealed this decision at the Council of State. = During the appeal, the DPA stood by its strict interpretation of legitimate interest. The DPA argued that the District Court misconstrued the concept of legitimate interest, as a legitimate interest must follow from the law. It repeated that VoetbalTV's interest was purely commercial which does not qualify as a legitimate interest as this is not an interest provided for by law. The DPA substantiated this by saying that interpreting legitimate interes