CJEU case C‑621/22 Koninklijke Nederlandse Lawn Tennisbond – CJEU Judgment (Netherlands, 2024)

The controller is a tennis federation. Members of an affiliated tennis association, they automatically become a member of the tennis federation. In 2018, the controller supplied two of its sponsors (a Sporting equipment retailer and a online betting company) with the personal data of its members in exchange for money. The sponsors used the personal data for marketing purposes. After complaints were lodged by members of the controller with the Dutch DPA (Autoriteit Persoonsgegevens), itheld that the controller had violated Articles 6(1)(a) and (f) GDPR in combination with Article 5(1)(a) GDPR, as it had disclosed personal data without the consent of the data subjects or any other valid legal basis. The DPA purported that only an interest in law, with a legal basis can prove a legitimate interest under the GDPR and fined the controller €525,000. The controller brought an action against the DPA’s decision before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam) and argued that the disclosure of the personal data of its members was justified due to a legitimate interest as per Article 6(1)(f) GDPR. The legitimate interest is comprised of creating a close connection with the data subjects and being able to offer them discounts and offers from sponsors enabling them to play tennis at a more affordable price. In general, the controller argued that any interest, as long as it is not unlawful, can constitute a legitimate interest. On the 22 September 2022, the District Court requested a preliminary ruling by the CJEU since it had doubts as to the interpretation of legitimate interests under Article 6(1)(f) GDPR and so posed the following three questions to the CJEU: 1. How should the District Court interpret legitimate interests under Article 6(1)(f) GDPR? 2. Is it to be interpreted as encompassing only interests founded in law? 3. Can any interest classify as a legitimate interest as long as it is not unlawful? More specifically: can a purely commercial interest and the present interest, namely the provision of personal data for a fee without the consent of the data subject, be classified as a legitimate interest under certain circumstances? If so, what circumstances determine whether a purely commercial interest is a legitimate interest? The court decided to answer the questions together and referred to the judgment C 252/21, recalling that the legal basis of legitimate interest under Article 6(1)(f) GDPR should be interpreted narrowly as they legitimise the processing of personal data without the data subjects consent. However, in principle, a wide range of interests is capable of being regarded as legitimate and as per Recital 47, a legitimate interest must not be grounded in law. The court highlights that the recital cites direct marketing purposes in general as an example of legitimate interests that may be pursued by a controller. Therefore, a legitimate interest is not limited to interests enshrined in and determined by law. The court states that the interest must be analysed taking into account the applicable legal framework and all the circumstances of the case. In addition to the pursuit of a legitimate interest the processing of personal data has to be necessary for the purposes of the legitimate interests pursued. Also, a balancing test between the data subject’s interests or fundamental freedoms and rights over the legitimate interest of the controller has to be performed. As to the necessity, the processing is only necessary when the legitimate interest pursued cannot reasonably be achieved as effectively by other – less restrictive – means. In the case at hand, the controller could have informed its members beforehand and asked whether they agree to the transmission of their data to the sponsors for marketing purposes. This alternative would limit the disclosure of data to what is absolutely necessary. Regarding the balancing test, the court highlighted that the disclosure of data to a sponsor operating casinos and gambling websites could even have negative effects on the data subjects (e.g. the risk to develop gambling addiction). Particular importance must be attached to the question whether, at the time when their personal data were collected for the purpose of joining a tennis club, those members could reasonably have foreseen that those data would be disclosed to third parties for marketing purposes, in return for payment The court concluded that a legitimate interest does not have to follow from a legal norm but it must be lawful. Further, an interest only meets the requirements of Article 6(1)(f) GDPR if it is absolutely necessary and the fundamental rights and freedoms of the data subjects do not outweigh this interest.