CJEU case C‑621/22 Koninklijke Nederlandse Lawn Tennisbond – CJEU Judgment (Netherlands, 2024)

The controller is a tennis federation. Members of an affiliated tennis association, they automatically become a member of the tennis federation. In 2018, the controller supplied two of its sponsors (a Sporting equipment retailer and a online betting company) with the personal data of its members in exchange for money. The sponsors used the personal data for marketing purposes. After complaints were lodged by members of the controller with the Dutch DPA (Autoriteit Persoonsgegevens), itheld that the controller had violated Articles 6(1)(a) and (f) GDPR in combination with Article 5(1)(a) GDPR, as it had disclosed personal data without the consent of the data subjects or any other valid legal basis. The DPA purported that only an interest in law, with a legal basis can prove a legitimate interest under the GDPR and fined the controller €525,000. The controller brought an action against the DPA’s decision before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam) and argued that the disclosure of the personal data of its members was justified due to a legitimate interest as per Article 6(1)(f) GDPR. The legitimate interest is comprised of creating a close connection with the data subjects and being able to offer them discounts and offers from sponsors enabling them to play tennis at a more affordable price. In general, the controller argued that any interest, as long as it is not unlawful, can constitute a legitimate interest. On the 22 September 2022, the District Court requested a preliminary ruling by the CJEU since it had doubts as to the interpretation of legitimate interests under Article 6(1)(f) GDPR and so posed the following three questions to the CJEU: 1. How should the District Court interpret legitimate interests under Article 6(1)(f) GDPR? 2. Is it to be interpreted as encompassing only interests founded in law? 3. Can any interest classify as a legitimate interest as long as it is not unlawful? More specifically: can a purely commer