The saga continues: Council of State also overturns Dutch DPA GDPR fine

Back in November 2020, we wrote a blog about the decision of the District court Midden-Nederland in which the GDPR fine, imposed by the Dutch Data Protection Authority ("DPA"), was overturned. This blog is available on our website. Recently, the Council of State confirmed the decision of the District court Midden-Nederland that VoetbalTV does not have to pay a fine of EUR 575.000 to the DPA.

Background of the case

VoetbalTV was an online videoplatform broadcasting amateur football games. It was an initiative of the Royal Dutch Football Organisation, ("KNVB"). Users of the videoplatform were able to watch games and highlights. The DPA investigated the activities of VoetbalTV because filming football players and registering and sharing these images qualifies as a data processing activity under article 4 of the GDPR. VoetbalTV used legitimate interest as a lawful basis for its data processing activities.

Interpretation of legitimate interest by the DPA

The DPA is of the opinion that a commercial interest cannot amount to a legitimate interest within the meaning of the GDPR. A legitimate interest is only lawful if it stems from a legal provision. Commercial interests are not vested in a legal provision. This is a rather strict interpretation and one that is not shared among other DPA's in the European Union. Recently, a discussion between the European Commission and the DPA was made available to the public. This discussion revealed that the European Commission does not agree with the position of the DPA and that using such a strict interpretation could even result in negative effects for businesses.

Interpretation of legitimate interest by VoetbalTV

VoetbalTV argued that its legitimate interest was not purely commercial as other interests were involved as well. These interests include the fact that VoetbalTV enabled football teams to carry out analyses of games, family members & friends were able to watch clips, and overall amateur football gained more attention as result of this platform.

District court Midden-Nederland

The court clarified that only an interest contradictory to statutory law cannot amount to a legitimate interest. It rejected the interpretation of the DPA that only interests laid down in statutory law are legitimate. However, the District court Midden-Nederland did not clarify whether a commercial interest can amount to a legitimate interest within the meaning of the GDPR.

Council of State

The DPA appealed against the decision of the District court. The Council confirmed the decision of the District court and acknowledged that VoetbalTV did not only have a commercial interest in carrying out its data processing activities. Therefore, the DPA should have properly assessed the other interests of VoetbalTV as well.

The Council of State did not provide any guidance whether an interest that is purely of a commercial nature can amount to a legitimate interest. However, by reading in between the lines it becomes clear that the Council of State does not agree with the strict interpretation of the DPA. The other interests of VoetbalTV are considered to be legitimate without being based on statutory law.

Furthermore, the Council clarified that data controller must establish its interests and clarify why personal data is necessary to serve these interests. During its investigations the DPA must carry out assessments whether the data processing activities truly serve the interests stated by the controller.

What's next?

This judgment could also lead to another fine being overturned as the DPA fined another organisation based on the same interpretation of a legitimate interest.

An important take away is that businesses must carry out proper assessments of their interests when relying on a legitimate interest for their data processing activities. A data processing activity serving multiple legitimate interests, including commercial interests, is lawful. This seems to be the suitable approach until the DPA has amended its strict interpretation.

Please contact us should you have any questions: Laurent van der Bruggen & Ady van Nieuwenhuizen.