Explanation AP of legitimate interest in direct marketing too restrictive?

In an earlier article from 2020, we already substantiated our doubts about the standards for legitimate interest in processing personal data in direct marketing set by the Dutch Data Protection Authority (AP).

The judgment of the Court of Justice of the EU (CJEU) of 4 October 2024, case number C-621/22, provides an interpretation that is consistent with the (explanation of) the GDPR.

However, this is not the end of the story, because the judgment of the CJEU is a so-called preliminary ruling. In other words, an advice requested by the Dutch court on the interpretation of EU law in this case the GDPR.

This case concerns a fine of EUR 525,000 imposed by the AP on the Royal Dutch Lawn Tennis Association (KNLTB), for providing personal data of their members to two of their sponsors.

Back to Basics: The GDPR

In various statements in the press about this ruling, it is noted that the AP is being reprimanded. Nowhere in the ruling of the CJEU is reference made to the policy of the AP, or is this explicitly tested. The CJEU returns to basics, namely the GDPR, and declares that Article 6, paragraph 1, first subparagraph, under f), of the GDPR must be interpreted as follows:

processing of personal data consisting in the provision of personal data of members of a sports association in return for payment for the purposes of a commercial interest of the controller may be regarded as necessary for the purposes of the legitimate interests pursued by that controller within the meaning of this provision only if such processing is strictly necessary for the purposes of the legitimate interest in question and the interests and fundamental rights and freedoms of those members, taking into account all the relevant circumstances, do not override such legitimate interest. While this provision does not require such an interest to be determined by law, it does require that the legitimate interest relied on be lawful.

Open end

By not referring to the AP’s policy, and the specific additional restrictions that the AP has included in its policy, we are not really certain of the interpretation of the GDPR on this point. In the AP’s policy, direct marketing interests are captured under ‘Informing existing customers after a purchase about similar, own products or services.’

This is a more limited interpretation, because it must concern existing customers and similar, own products or services. This limited interpretation has not been followed, but also not explicitly rejected.

It remains to be seen how the assessment will ultimately turn out in the Dutch court.

To be continued, no doubt.

Advice

Do you have any questions about the above developments or do you have other legal questions about privacy law? Our specialized lawyers are happy to help you. You can contact one of our  lawyers  via  email, telephone or fill out the contact form for an initial consultation. We are happy to assist you.