Autoriteit Persoonsgegevens (AP) – Court Ruling (Netherlands, 2022)

The controller is a sports club in the legal form of an association. To, in its own words, 'give more meaning' to the sport, its vision and the memberships of its members, the controller worked with sponsors. It provided these sponsors with personal information of its members (the data subjects) such as names and addresses. Some members complained to the Dutch DPA that they did not give the controller explicit consent to provide its sponsors with their personal data. The Dutch DPA investigated the matter and found that the controller had disclosed the personal data without consent or any other legal ground, in breach of Article 5(1)(b) and Article 6(1) read in conjunction with Article 5(1)(a) GDPR. The DPA fined the controller €525,000. The controller appealed the DPA's decision at the District Court of Amsterdam. It stated that there was, in fact, a legal ground for processing and this was its legitimate interest under Article 6(1)(f) GDPR. The DPA continued to be of the opinion that the controller had no legitimate interest and that the processing was not necessary to pursue such alleged legitimate interest. The parties were divided on the interpretation and scope of legitimate interest within the meaning of Article 6(1)(f) GDPR. According to the DPA, it followed from the grammatical interpretation of this term that there must be an interest laid down in a law. According to the controller, any interest was justified unless prohibited by law. The Court noted that there were three cumulative conditions according to established case law of the CJEU for processing on the grounds of legitimate interest: (1) the pursuit of a legitimate interest of the controller, (2) the processing must be necessary and (3) the controller's legitimate interest must outweigh the interest or fundamental fights and freedoms of the data subject(s). The Court held that it could not without reasonable doubt decide whether the controller had a legitimate interest. There was no established