The Netherlands’ data protection authority’s strict interpretation of the GDPR’s “legitimate interest” ground for processing data has sparked a wave of criticism from privacy law professionals, local courts and even the European Commission.
While privacy law professionals don’t believe the Dutch interpretation is likely to catch on in other EU nations, what happened in the Netherlands underscores the tensions between local DPAs and the European Commission on interpretations of the GDPR, which will likely prompt more guidance to come out in the near future.
The Dutch Take on Legitimate Interest
Under the General Data Protection Regulation (GDPR), organizations must be able to rely on a ground to allow for lawful processing of data, said Quinten Kroes, a partner at Brinkhof in Amsterdam. One of the lawful grounds listed by the EU is the one often referred to as “legitimate interest.”
To rely on legitimate interest, organizations must pass a three-pronged test, including whether the processing of data is necessary to meet that interest and whether there is an appropriate balancing of interests between the data controller and subjects, Kroes said.
In 2019, the Dutch DPA took the controversial position that the legitimate interest ground could not be used for a commercial interest.
That year, the Dutch regulator expressed concerns over the practice of VoetbalTV, a company that put automated cameras on the fields of amateur soccer clubs to live stream games to viewers through an application on their phone. In a report, the regulator stated that, despite having done a comprehensive privacy impact assessment, the company did not have lawful grounds to process the video images.
“The reasoning they gave for that was the surprising bit because they said, you claim that you have this legitimate interest, but we don’t find it legitimate at all because in the end, you’re just in it to make a buck,” Kroes said. “Making money, that can never be a sole justification for processing personal data. Now, to me as a privacy law specialist, that was a very surprising interpretation. And I’d never seen it before.”
To be sure, Kroes wasn’t the only one surprised.
“Many began to think, what are you doing DPA? This is outrageous. Also, the guidance is really quite brief, so it doesn’t give a lot of support to the statement that a profit optimization or commercial interest can’t be a legitimate interest, they just put it out there,” said Nathalja Doing, an associate at Baker & McKenzie in Amsterdam.
An Isolated Position?
Despite the surprise at the decision, privacy law professionals don’t expect the Dutch interpretation to catch on with other EU nations.
“I don’t think there is a risk that any of the other jurisdictions would follow the interpretation of the Dutch privacy authority because the Dutch privacy authority seems to stand alone in its stubborn, strict interpretation of how to interpret the legitimate interest under the GDPR,” said Remke Scheepstra, a partner at Baker & McKenzie in Amsterdam.
In the last couple of years, the Dutch DPA’s interpretation has faced criticism and pushback, not only from within the Netherlands but also at the EU level.
“[The district court] and also the European Commission, they reject the idea that certain categories of interests are excluded from being a legitimate interest such as what the Dutch DPA is trying to say,” Doing said.
In the fall of 2020, a Netherlands district court ruled against the Dutch regulator’s interpretation, Kroes said. The Dutch DPA appealed that decision and many are now waiting for a ruling from the Supreme Court of the Netherlands which could come in the next following weeks. Still, some wonder whether the case should be referred to the Court of Justice of the European Union.
While it is difficult to predict what the CJEU will rule, the European Commission’s position made it clear that the Dutch’s interpretation doesn’t appear to align with the GDPR guidelines.
In a letter sent to the Dutch regulator in March 2020 that recently became public, the European Commission noted that while he supports the issuance of national guidelines, such guidelines must remain in line with those adopted on the European Data Protection Board level.
In the letter, Emmanuel Crabit, the director for fundamental rights and rule of law at the European Commission’s directorate general for justice and consumers, said he was “concerned by the strict interpretation” from the Dutch DPA and noted that “such a strict interpretation is not in line with the GDPR.”
He added that “the GDPR underlines that the right to protection of personal data is not an absolute right and it has to be balanced against other fundamental rights, such as the freedom to conduct a business” and that the Dutch DPA’s interpretation “does not allow an appropriate balance.”
The letter ended with an invitation to “readjust the language of the standard explanation note to clearly reflect that commercial interests can be regarded as ‘legitimate’ interests when (subject to a concrete balancing) they are not overridden by the fundamental rights and freedoms of the data subject.”
More Interpretations to Come?
Still, the European Commission’s letter didn’t seem to have an impact on the Dutch DPA’s position. Since the VoetbalTV case, Kroes said the regulator has rejected the use of legitimate ground in another case and imposed a fine on the Royal Dutch Tennis Association for sending advertising mailings to their members.
The Netherlands district court is currently reviewing that case and has indicated its intent to refer the matter to the EU court of justice, Kroes said. The court’s decision is expected in the next couple of weeks.
While privacy lawyers await the rulings from the Netherlands courts on those two cases, what’s sure is that the legitimate interest ground is key to many forms of processing, Kroes said, “so if it were indeed to be restricted in the way that our Dutch regulator seems to think it should be, this will have a far reaching impact on many forms of processing.”
Doing added that excluding certain categories of interest would make categorizing for businesses “unmanageable” and “create a lot of legal uncertainty.”
In the meantime, Kroes said the European Data Protection Board is working on new guidance about legitimate interests.
“I think the most interesting thing to see … is whether they will still uphold that or whether they will veer more toward the Dutch stricter approach,” Kroes said.
