VoetbalTV – Court Ruling (Netherlands, 2022)

VoetbalTV (the controller) is a collaboration between the Royal Dutch Football Association and Talpa Network. The online platform allowed fans to (re)watch and analyze professional video footage of football matches played by amateur players (the data subjects). VoetbalTV based its processing activities on a legitimate interest. = The Dutch DPA investigated Voetbal TV in 2019 and imposed a fine of €575.000 for processing personal data without a legal basis. The DPA held that VoetbalTV had a purely commercial interest, which can never be legitimate interest pursuant to Article 6(1)(f) GDPR. The DPA followed that a legitimate interest should (1) stem from a legal provision, (2) be worthy of protection and (3) have an urgent nature. According to the DPA, a purely commercial interests was not specific enough and lacked an urgent legal nature. VoetbalTV appealed this decision at the District Court. = The court found that the DPA gave a wrong interpretation of legitimate interest. It noted that having a purely commercial interest does not exclude a legitimate interest. The further held that the DPA did not sufficiently substantiate its decision. It should have investigated all the interests of VoetbalTV and weigh them against the violation of the privacy of those involved. Therefore, the Court held that the DPA should not have issued the fine and annulled the decision (see: [https://gdprhub.eu/index.php?title=Rb._Midden-Nederland_-_UTR_20/2315 UTR 20/2315]). The DPA appealed this decision at the Council of State. = During the appeal, the DPA stood by its strict interpretation of legitimate interest. The DPA argued that the District Court misconstrued the concept of legitimate interest, as a legitimate interest must follow from the law. It repeated that VoetbalTV's interest was purely commercial which does not qualify as a legitimate interest as this is not an interest provided for by law. The DPA substantiated this by saying that interpreting legitimate interest in a broader sense seemed illogical in light of the objective pursued by the GDPR and even conflicts with the interpretation of Article 8 ECHR.The DPA did not expain why a broad interpretation of the concept of legitimate interest conflicts with the GDPR and Article 8 ECHR (or at least this did not follow from the decision of the Council of State) Even if VoetbalTV had a legitimate interest, the processing was still unnecessary and balancing the interests at stake would have been in favor of the data subjects according to the DPA. The DPA also requested prejudicial questions, as the CJEU had not given an opinion on the topic of a solely commercial interest as a legitimate interest. VoetbalTV argued that a legitimate interest is an interest that is not in conflict with the law and that the DPA wrongly labelled its interest as purely commercial. VoetbalTV argued that the platform also (1) enhanced the involvement and enjoyment of fans, (2) facilitated technical analyses by trainers and analysts, and (3) offered players, friends and family the possibility to watch or review the matches remotely. The Council of State agreed with the District Court that the DPA gave a wrong interpretation of the concept of legitimate interest. The Council of State noted that to successfully rely on legitimate interest as a legal basis, three conditions must be met pursuant to the FashionID case: a legitimate interest, necessity and a balancing test. The Council held that the organization that processes the personal data indicates what its interest are and why processing is necessary for that purpose. The DPA must then test that interest against the FashionID criteria. The Council held that VoetbalTV's interest were not purely commercial in nature. The DPA wrongly disregarded the other interests that VoetbalTV put forward during its assessment. In addition, the Council held that the DPA neglected to assess whether the processing was necessary and weigh the interests of VoetbalTV against those of the players. The Council held that the DPA failed to perform the three-step test completely and the decision was therefore insufficiently motivated. The Council noted that because it had been established that the interests in question were not purely commercial in nature, the question whether an exclusively commercial interest could in itself be a legitimate interest did not need answering. Hence no prejudicial question was required. The Council of State held that the appeal lodged by the DPA was unfounded and the judgement under appeal must be upheld.