The pleasantly terse ruling of the ECJ in the Case. C‑621/22 of October 4, 2024 concerned legitimate interests, more specifically the question of whether a legitimate interest can justify the disclosure of member data by a sports association to sponsors for advertising purposes in return for payment.
The ECJ first recalls that the legitimate interest applies if (i) the processing pursues a legitimate interest of the person responsible or a third party (ii) the processing for this purpose required (which requires appropriate assessment and data minimization) and (iii) does not adversely affect the interests or fundamental rights and freedoms of the data subject(s). predominate (which the substantive court must examine). These interests are also set out in the privacy policy to disclose (according to the GDPR – in Switzerland there are contrary to the wishes of the FDPIC no obligation to state overriding interests).
“Legitimate” interests are not only those that have found legal expression – any other interest is sufficient, provided that it lawful is. But also economic interests are fundamentally justified and may prevail – this is not new and is actually self-evident, but was nevertheless not uncontroversial:
48 In that regard, the Court has It cannot be ruled out that an economic interest of the controller, which consists in the advertising and sale of advertising space for marketing purposes, can be regarded as a legitimate interest within the meaning of Art. 6 para. 1 subpara. 1 letter f GDPR […].
49 In these circumstances, an economic interest of the controller such as that mentioned in para. 47 above could constitute a legitimate interest within the meaning of Art. 6(1)(1)(f) GDPR, unless it is unlawful is. However, it is for the referring court to assess the existence of such an interest on a case-by-case basis, taking into account the applicable legal framework and all the circumstances of the case.
However, under the heading of more lenient measures, the ECJ not only takes data minimization into account, but also the Possibility of consent:
51 As regards, secondly, the condition of the necessity of that processing for the purposes of the interest in question and, in particular, the existence of means which are equally suitable and less intrusive on the fundamental rights and freedoms of the data subjects, it must be held that a sports association such as the KNLTB, which wishes to disclose personal data of its members to third parties in return for payment, in particular would be possible to inform its members in advance and ask themwhether they want their data to be passed on to third parties for advertising or marketing purposes.
52 This solution would allow the members concerned to retain control over the disclosure of their personal data, in accordance with the principle of data minimization referred to in recital 43 above, thus limiting the disclosure of those data to what is actually necessary and relevant for the purposes for which those data are transmitted and processed […].
53 A procedure such as that described in the preceding paragraph could have a less intervention the right to protection of the confidentiality of the data subject’s personal data and at the same time enable the controller to justify the legitimate interest asserted by the data subject. to perceive effectivelyHowever, it is for the referring court to examine this […].
The present court must then examine the Weighing of interests carry out. The ECJ does not anticipate its outcome, but gives an indication. Two points are interesting here – the particular weight of the expectations of those affected (which some authorities understand as an objective question that cannot simply be influenced by a privacy policy) and the fact that the ECJ also takes into account whether a dangerous – albeit legal – product is to be advertised:
55 In carrying out that balancing exercise, the referring court must determine whether the right to privacy of members of tennis clubs, enshrined in Article 8(1) of the Charter and Article 16(1) TFEU, takes precedence over the economic interest of a national tennis association in the processing of their personal data. As stated in recital 47 of the GDPR, particular importance must be attached to the question of whether, at the time their personal data is collected for the purpose of joining a tennis club could reasonably foreseethat this data is disclosed to third parties, in this case sponsors of the KNLTB, for advertising and marketing purposes in return for payment.
56 Furthermore, the referring court will have to take into account the fact that the data in question are transferred, inter alia, to a provider of gambling and casino games, such as NLO, whose advertising and marketing activities, even if lawful, take place in a context which, contrary to recital 47 in the preamble to the GDPR not characterized by a relevant and appropriate relationship between the data subjects and the controller appears to be unlawful. Furthermore, the processing of such data could, in certain circumstances, adversely affect the members of the tennis clubs concerned, as it exposes them to the Risk of developing a gambling addiction could be exposed.
The sports association should certainly not have high hopes – after these indications, it will hardly be granted sufficient legitimate interest.