Apparently the Dutch data protection authority standardly expressed the view that the legal basis of the legitimate interest does not include purely commercial interests.
The EU Commission has therefore intervened and has asked the authority in a letter reminded that also the Economic freedom is a fundamental right enshrined in the EU Charter, and that the GDPR also recognizes (in recital 4) that “the right to the protection of personal data […] is not an unlimited right” but that it must be “seen in the light of its societal function and weighed against other fundamental rights in compliance with the principle of proportionality”. The strict interpretation of the Dutch authority prevented such a balancing:
Against this background, we invite the Dutch DPA to readjust the language of the standard explanation note to clearly reflect that commercial interests can be regarded as ‘legitimate’ interests when (subject to a concrete balancing) they are not overridden by the fundamental rights and freedoms of the data subject.
However, the authority does not seem to be impressed by this. The chairman of the authority has apparently expressed his intention not to join the commission.
This became known via a report in a Dutch newspaper, about which again Hogan Lovells has reported.