Rb. Midden-Nederland - UTR 20/2315

Rb. Midden-Nederland - UTR 20/2315
Court:	Rb. Midden-Nederland (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 6(1)(f) GDPR
Decided:	23.11.2020
Published:	23.11.2020
Parties:	VoetbalTV Dutch DPA (Autoriteit Persoonsgegevens)
National Case Number/Name:	UTR 20/2315
European Case Law Identifier:	ECLI:NL:RBMNE:2020:5111
Appeal from:
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	Rechtspraak.nl (in Dutch)
Initial Contributor:	Patrick Schreurs

The District Court of Central Netherlands held that VoetbalTV doesn’t have to pay a fine issued by the Dutch DPA. The court did not agree with the restrictive interpretation by the Dutch DPA concerning legitimate interest (Article 6(1)(f) GDPR).

English Summary

Facts

VoetbalTV, an initiative of the Royal Dutch Football Association (KNVB) and broadcasting company Talpa Network, is recording and broadcasting amateur football. The Dutch DPA fined VoetbalTV for processing personal data without a valid lawful basis. The Dutch DPA published guidance in which it states that a legitimate interest is only legitimate if it stems from a legal provision. Also, a purely commercial interest can never be a legitimate interest, according to the Dutch DPA. VoetbalTV appealed the decision.

Dispute

Does a legitimate interest (Article 6(1)(f) GDPR) need to stem from a legal provision and can a purely commercial interest result in a legitimate interest?

Holding

The court does not agree with the restrictive interpretation of legitimate interest by the Dutch DPA. Any interest can be a legitimate interest as long as it is not against the law (negative test). The Dutch DPA should have performed a balancing test in order to balance the interests pursued by VoetbalTV against the interests or fundamental rights and freedoms of the data subjects. Because the DPA did not perform such a balancing test, the court annulled the decision and the imposed fine.

The court annulled the decision and decided to judge the case itself (Article 8:72a Dutch General Administrative Law Act). Then the court decided to not take a new decision in order to replace the annulled decision, noting that the fine is now completely off the table.

Comment

VoetbalTV started this proceeding because the Dutch DPA issued a negative opinion about VoetbalTV, but did follow up with a final decision for a long time. As a result VoetbalTV was unable to challenge the opinion of the Dutch DPA. This long-term investigation resulted in the fact that VoetbalTV is now bankrupt.

The decision was appealed at the Council of State (see hub summary).

Further Resources

Share blogs or news articles here!

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

Statement

COURT OF THE MIDDLE NETHERLANDS

Seat in Utrecht

Administrative law

case number: UTR 20/2315

Judgment of the Multi-Judge of 23 November 2020 in the case between

VoetbalTV BV, in Amsterdam, plaintiff

(authorized representative: mr. QR Kroes and mr. M. Oostveen),

and

Dutch Data Protection Authority, defendant

(authorized representative: mr. E. Nijhof and mr. OS Nijveld).

Process course

Plaintiff lodged an appeal with the court on May 20, 2020 because the defendant, despite an earlier intention to do so, did not take a decision to enforce it.

In its decision of 16 July 2020 (the contested decision), the defendant imposed a fine of € 575,000 on the plaintiff for the unlawful processing of personal data.

The appeal against the late decision, on the basis of Article 6:20, third paragraph, of the General Administrative Law Act (Awb), also relates to the contested decision.

Respondent has lodged a statement of defense.

The hearing took place on October 12, 2020. Its directors M. Hoffer and M. Balken, and its agents, appeared on behalf of Plaintiff. The defendant was represented by his attorneys.

Considerations

preface

    On September 11, 2020, the Central Netherlands District Court pronounced the plaintiff's bankruptcy. However, before the plaintiff was declared bankrupt, the parties were invited to a hearing of the court and therefore, in view of Article 8:22, second paragraph of the Awb, Article 27, second paragraph, of the Bankruptcy Act does not apply. The plaintiff's appeal can therefore be heard by the court despite her bankruptcy.

    This judgment concerns a fine imposed by the defendant on the plaintiff. The legal framework is included in the appendix that forms part of this judgment.

    VoetbalTV is a video platform for amateur football. Plaintiff makes video recordings of amateur football matches on behalf of football clubs. At the beginning of 2020, 153 clubs participated in VoetbalTV and approximately 2500 to 3000 matches were recorded and broadcast every month. In addition, VoetbalTV is a social platform. The VoetbalTV app is used by an estimated 520,000 people. On the VoetbalTV platform you can watch football moments, analyze matches, collect data and share it with others. Plaintiff's own editorial team also collects and displays 'highlights' such as goals and odds. In addition, trainers / analysts can use an analysis tool.

    Respondent has investigated the privacy of players and spectators. This investigation resulted in a draft investigation report of 15 May 2019 and, after the plaintiff submitted an opinion, to a final investigation report of 6 November 2019, in which the defendant concludes that the plaintiff is unlawfully processing personal data. Respondent issued its intention to proceed with enforcement on November 22, 2019. Because a decision to enforce was not forthcoming, Plaintiff filed an appeal against the late decision on 20 May 2020. The defendant subsequently took the contested decision on 16 July 2020.

About the appeal against late decision

5. The appeal lodged by the plaintiff against the late decision also relates by operation of law to the contested decision. Plaintiff no longer has an interest in an assessment of her appeal against the late decision, because a decision has meanwhile been taken. That is why the court declares the appeal against the late decision inadmissible.

About the contested decision

6. The defendant has imposed a fine on the plaintiff in the amount of € 575,000 because it has unlawfully processed personal data. The defendant accuses the plaintiff of having made video recordings of a large number of amateur football matches without lawful basis and having further distributed these images to a large audience via the VoetbalTV app and via the analysis tools. In doing so, it acted in violation of Article 5, first paragraph, opening words and under a, in conjunction with Article 6, first paragraph, of the General Data Protection Regulation (GDPR). According to the defendant, the plaintiff has infringed the right to respect for privacy and the right to the protection of personal data of a large number of data subjects, including many minors.As a result, these data subjects have lost (in part) control over their personal data. Respondent considers this to be a serious offense that warrants a large fine.

Journalistic exception

7. Plaintiff does not agree with this. First, it argues that the defendant is wholly (or partially) unauthorized to impose a fine for the processing of the personal data, because the journalistic exception of Article 85 GDPR in conjunction with Article 43 of the General Data Protection Regulation Implementation Act (UAVG) in this case applies to the data processing. According to the plaintiff, the defendant himself also thinks that this applies -for at least part of the processing of personal data-, because the investigation report does not refer to the editorial articles of VoetbalTV. Plaintiff will first have to make video recordings of amateur football matches before she can compile and distribute images with news value. According to the plaintiff, the defendant cannot therefore judge the entire processing of the video images of the plaintiff.Moreover, according to the plaintiff, the respondent applies the journalistic exception too rigidly and uses an incorrect standard. Although the defendant refers to the settled case law of the European Court of Human Rights (ECHR) and the Court of Justice (CJEU) and thus appears to recognize that the journalistic objection must be interpreted broadly, he ignores the fact that the plaintiff is a media company and that the processing takes place in that context. According to the plaintiff, it follows from European case law that the journalistic exception must concern activities aimed at disclosing information, opinions or ideas to the public, regardless of the transmission medium. According to her, that is the case here. Respondent misunderstands the news value and social relevance of (integrated) sports broadcasts.The CJEU has explicitly ruled that having a commercial (secondary) purpose does not preclude this qualification. The defendant wrongly takes the position that the processing of these data only leads to the satisfaction of curiosity. The case law to which the defendant refers is not relevant to this situation according to the plaintiff.

8. The court does not follow the plaintiff in its position that the defendant itself also believes that the editorial activities would fall under the journalistic exception. The defendant has stated that the editorial activities of the plaintiff were not involved in the investigation and that this processing of personal data therefore did not lead to the fine. The respondent has not commented at all on the question whether the journalistic exception applies to this processing of personal data. The fine imposed on the plaintiff is about the unlawful making of video recordings according to the defendant and the large-scale distribution thereof. The court sees no indication for a different point of view in the investigation report and the fine decision.

9. The journalistic exception applies to the processing of personal data that only takes place (exclusively) for journalistic purposes. 1 In answering the question whether the processing of personal data fined by the defendant falls under the journalistic exception, the court adheres to European case law, as laid down in, among other things, the judgments of the CJEU on Satamedia 2 and Buidvids 3 and the judgment of the ECtHR on Satamedia. 4It follows from those judgments that the journalistic exception must be interpreted broadly in the interests of freedom of expression. This exception applies not only to media companies, but to all journalistic activities, as long as their purpose is to disseminate information, opinions or ideas to the public. The transmission medium is not important here. It is also up to the court to assess whether the processing of personal data only pursues a journalistic purpose. It is irrelevant that the disclosure to the public is also for profit.Moreover, it follows from the ECtHR's Satamedia judgment that the fact that there is a social interest in allowing journalists to collect and process personal data for a publication that contributes to a public debate does not mean that the unfiltered publication of this collected personal data also serves a social interest.5

10. The court is of the opinion that recording the football matches and broadcasting them to the public does not in this case only serve a journalistic purpose and thus follows the defendant's position. Indeed, the broadcast of amateur football matches cannot be regarded as a disclosure to the public of information, opinions or ideas. The competitions have too little news value for that; it is about broadcasting amateur sports and games. The images do not provide information about famous persons, such as famous football players, and do not contribute to any social debate. It concerns the unfiltered processing of a large amount of personal data collected by the plaintiff herself. The processing operations as a whole do not have an exclusively journalistic purpose.The fact that all the images collected by her may contain newsworthy information does not mean that all thousands of broadcasted matches can be seen as journalism and does not justify the recording and broadcasting of all these matches. The plaintiff's argument is therefore unsuccessful and the defendant is authorized as a supervisor to investigate the plaintiff's data processing. The journalistic exception therefore does not apply to the data processing that this procedure is about. Plaintiff's argument is therefore unsuccessful.The plaintiff's argument is therefore unsuccessful and the defendant is authorized as a supervisor to investigate the plaintiff's data processing. The journalistic exception therefore does not apply to the data processing that this procedure is about. Plaintiff's argument is therefore unsuccessful.The plaintiff's argument is therefore unsuccessful and the defendant is authorized as a supervisor to investigate the plaintiff's data processing. The journalistic exception therefore does not apply to the data processing that this procedure is about. Plaintiff's argument is therefore unsuccessful.

Legitimate interest

11. The defendant has based the fine on the fact that the plaintiff is processing data unlawfully, because that processing is not necessary for the representation of the legitimate interests of the controller or of a third party, thus not complying with Article 6, first paragraph, opening words and under f of the GDPR. Respondent takes the position that a legitimate interest is an interest that has been designated as a legal interest in (general) legislation or elsewhere in the law. It must therefore be an interest that is also protected in law, that is considered worthy of protection and that in principle must be respected and can be 'enforced'. If an interest can be regarded as a legitimate interest,then this interest must have a more or less urgent and specific character arising from a (written or unwritten) rule of law or legal principle; in a sense it must be inevitable that these legitimate interests are promoted. Purely commercial interests and the importance of profit maximization are not specific enough and lack an urgent 'legal' character, so that they cannot be regarded as legitimate interests. The core of the plaintiff's activities consists of the processing of personal data and she earns money with that processing. It therefore has a purely economic interest in the processing of personal data. According to the respondent, this can never be a legitimate interest. If the performance of that core activity could be regarded as a legitimate interest,this means that the subsequent necessity test and balancing of interests become meaningless.

12. Plaintiff argues that this explanation of the defendant is contrary to the explanation of authoritative European working groups and committees, case law, experts and finally also the earlier explanation of the defendant itself. According to the plaintiff, a negative test must be applied to the question whether a processor has a legitimate interest, which means that 'justified' means: not contrary to the law. However, the defendant wrongly applies a positive test by stating that the plaintiff must have a legal interest. According to plaintiff this is incorrect.

13. The court finds that personal data may only be processed if there is a basis for that processing. The principles are listed exhaustively in Article 6, first paragraph, of the GDPR. It is not disputed between the parties that the plaintiff does not have the consent of all parties involved whose personal data are processed for making video recordings and distributing images. Nor is there any processing that is necessary for the performance of an agreement. The court will therefore have to assess whether Plaintiff has a legitimate interest for which processing of personal data is necessary, as referred to in Article 6, first paragraph, opening lines and under f, of the GDPR.

14. For a successful appeal to Article 6, paragraph 1, opening lines and under f, of the GDPR, three conditions must be met. This follows from, among other things, the judgment of the CJEU on Fashion ID, 6 in which the CJEU explains Article 7 (f) of Directive 95/46, 7that is substantively equal to Article 6, first paragraph, opening lines and under f, of the GDPR. The first condition is that the interest pursued by the plaintiff is a legitimate interest. If that is the case, then it must be assessed whether the processing of the personal data is necessary for the promotion of that legitimate interest, which also involves assessing proportionality and subsidiarity: is the infringement for the data subjects in proportion to the processing? target? And cannot the goal be achieved in a way that is less disadvantageous for those involved? The third condition is that there must be a balance between the interests of the controller and those involved.

15. The case law of the CJEU does not provide a clear description of what a legitimate interest exactly is and the defendant's interpretation that - in short - it should concern a legal interest, has not been found as such in that case law. The respondent has also not referred to specific judgments in which this interpretation is endorsed. In his Opinion on the aforementioned judgment of the CJEU on Fashion ID, Advocate General M. Bobek 8 explains that Directive 95/46 also contains no definition or enumeration of what exactly the term 'legitimate interest' entails. According to Bobek, this concept is fairly flexible and open in nature and he refers to his own conclusion in the CJEU judgment on Rīgas satiksme, 9in which he mentions the judgments of the CJEU on Volker und Markus Schecke and Eifert, 10 and Ryneš 11 . Bobek also refers in his Opinion in Fashion ID to the judgments in Promusicae, 12 and Rīgas satiksme, 13to substantiate his position. Bobek mentions 'transparency' and 'protection of property, health and family life' as examples of legitimate interests. The Fashion ID case concerned the collection and transmission of personal data in order to be able to advertise as well as possible and that could also be a legitimate interest, according to Bobek. If legal in itself, there is, according to Bobek, no type of interest that is necessarily excluded. Bobek bases this conclusion, among other things, on the opinion of the Article 29 Working Group (WP29, the predecessor of the European Data Protection Board (EDPB)). In her 2014 opinion, 14the WP29 has written that the legitimate interest should be interpreted as a concept that can encompass a range of different interests, whether they are trivial or compelling interests, and whether these are evident or more controversial, provided it is an actual and present (and therefore not speculative) is important. Not only legal, but also all kinds of factual, economic and idealistic interests can therefore qualify as legitimate interests.

The CJEU has repeatedly confirmed that Member States are not free to exclude in advance or categorically invoking legitimate interest for certain categories of processing operations. 15

16. In view of the aforementioned European case law, conclusions of the Advocate General and the opinion of the WP29, the court endorses the plaintiff's position that the question whether a processor of personal data has a legitimate interest, on the basis of a negative test must be assessed. This test means that the processor may not pursue an interest that is contrary to the law. The fact that the legitimate interest of Article 6, first paragraph, opening words and under f, of the GDPR should not be seen as a more or less legal interest, as the respondent believes, but much more as a legitimate interest, is also in line with the foreign translations. of this concept, namely 'legitimate interests' (Eng.), 'Justice Interessen' (Du.) and 'des intérêts légitimes' (Fr.).A clear distinction has thus been made with the legal obligation referred to in Article 6, first paragraph, opening lines and under c, of the GDPR, 'legal obligation' (Eng.), 'Rechtlichen Verpflichtung' (Du.) And 'une obligation'. légale '(Fr.). The fact that the legitimate interest must be viewed through a negative test is also in line with recital 47 of the GDPR, which mentions 'direct marketing' as an example of a possible legitimate interest. In the opinion of the court, in designating this interest as a legitimate interest, no legal interest, as understood by the respondent, can be cited as a basis.The fact that the legitimate interest must be viewed through a negative test is also in line with recital 47 of the GDPR, which mentions 'direct marketing' as an example of a possible legitimate interest. In the opinion of the court, in designating this interest as a legitimate interest, no legal interest, as understood by the respondent, can be cited as a basis.The fact that the legitimate interest must be viewed through a negative test is also in line with recital 47 of the GDPR, which mentions 'direct marketing' as an example of a possible legitimate interest. In the opinion of the court, in designating this interest as a legitimate interest, no legal interest, as understood by the respondent, can be cited as a basis.

17. The plaintiff must then state what her legitimate interest is in the processing of personal data and she must actually act accordingly. The processing of personal data may not be in conflict with the law and may not go beyond its statutory purpose. In short: do not violate the law. The way in which the CJEU subsequently tests the admissibility of the processing of personal data also deviates from the defendant's assessment in this case, which is once again an indication that the defendant is taking too strict an approach. As an example, the court refers to the judgment of the CJEU regarding Google Spain and Google. 16In that judgment, the CJEU held that the processing of personal data at issue there may fall under Article 7 (f) of Directive 95/46, if this processing is necessary for the defense of the legitimate interest of the controller. or of the third party or parties to whom the data are disclosed, provided that the interest or fundamental rights and freedoms of the data subject, and in particular his right to respect for his privacy when processing personal data, which rights under Article 1 paragraph 1 of this Directive should be protected, not prevailed. Thus, the CJEU considers, the application of this Article 7 (f) necessarily entails a balancing of the conflicting rights and interests at issue,within the framework of which account must be taken of the importance of the rights of the data subject arising from Articles 7 and 8 of the Charter.

18. With the strict application that the defendant applies here, he has not arrived at such an assessment as described by the CJEU here. The defendant has therefore not interpreted the legitimate interest in an open and flexible manner, as it should. He thereby ignores the fact that the concept of 'legitimate' interest mainly serves as an external limit for the assessment and not as a threshold. The court is also not aware of any rulings in which the CJEU, without further assessment of the interests of both the processor and the data subject (s), finds that the processor has no legitimate interest at all in the processing and is acting unlawfully for that reason alone. . Defendants explain that in essence the plaintiff is only concerned with the monetization of personal data and that this interest can never be a legitimate interest,ignores the fact that the ECJ actually prohibits the pre-exclusion of certain legitimate interests. Nor does the court follow the defendant's conclusion that the necessity test and the balancing of interests are meaningless if it is assumed that the interest that the plaintiff is pursuing is a legitimate interest. The court will explain below why it does not agree with that position.

19. Respondent takes the position that the interest that the plaintiff pursues in processing personal data is a purely commercial interest, whereby she monetizes the personal data of others, including many minors. However, this is not the interest that Plaintiff herself states to pursue with VoetbalTV. She argues that her legitimate interest in broadcasting the images lies in a. Increasing the involvement and fun of football fans, including players who are portrayed, b. being able to perform technical analyzes for / by trainers and / or analysts of the football clubs and third parties and c. offering the possibility to, among others, players, friends and family members to be able to (re) watch matches remotely,for example if they cannot be physically present.

In addition, Plaintiff has a channelization function that is a legitimate interest for herself and the KNVB, because it contributes to a higher level of privacy protection and prevents the recording of matches via other channels.

20. As the court has already considered in legal consideration 17, it is up to the processor of the personal data to establish a legitimate interest. The court sees no leads for the defendant's conclusion that his interpretation of the plaintiff's interests should be leading. With due observance of consideration 47 of the GDPR, the defendant will have to assess whether it is necessary to process personal data on the basis of the objectives set by the plaintiff. It is up to the plaintiff to explain the extent to which it collects and processes data, how it has arranged this legally and how it ensures that there is an appropriate relationship between the invasion of the privacy of the data subjects and the interest it pursues (proportionality and subsidiarity).Subsequently, the defendant will have to weigh up the alleged interests against the violation of the privacy of those involved, including in this case underage children. The point here is that the defendant looks at what the plaintiff actually does, whether the goals correspond with its articles of association and are actually served by the processing of the personal data. If the respondent starts from the interests put forward by the plaintiff, he can therefore - contrary to what he assumes - carry out a necessity test and weighing up interests.If the respondent starts from the interests put forward by the plaintiff, he can therefore - contrary to what he assumes - carry out a necessity test and weighing up interests.If the respondent starts from the interests put forward by the plaintiff, he can therefore - contrary to what he assumes - carry out a necessity test and weighing up interests.

21. In summary, the court comes to the conclusion that the defendant's assessment in this case is based on a misinterpretation of the concept of 'legitimate interest' and is therefore contrary to Article 6, first paragraph, opening words and under f, of the GDPR. In the contested decision, the respondent also carried out a necessity test and weighing up interests in the alternative and takes the view that that assessment also leads to the data being processed unlawfully and that the fine was therefore correctly imposed.

22. However, the court finds that the investigation carried out by the defendant and the investigation report that he subsequently prepared do not concern the question whether it is necessary for the plaintiff to process the personal data for the purposes set by it. Proportionality and subsidiarity were not part of that assessment. Nor did the respondent weigh up the interests at that stage of the investigation. Because the defendant has not fully investigated the processing of personal data and has stopped when it establishes that the plaintiff has no legitimate interest, the other decision was not taken with sufficient care and is therefore contrary to Article 3: 2 of the Awb. The fine cannot therefore be maintained.

23. The appeal is well-founded and the court sets aside the contested decision of 16 July 2020. In application of Article 8: 72a of the Awb, the court sees reason to provide for the case itself, in the sense that it does not take any other decision in the location of the act nullified. This means that the fine is completely off the table. Because the court declares the appeal to be well-founded, the court determines that the defendant reimburses the plaintiff the court fee paid by it.

24. The court orders the defendant to pay the costs incurred by the plaintiff. On the basis of the Administrative Costs Decree, the court sets these costs for the professional legal aid provided by a third party at € 1,575 (1 point for submitting the notice of appeal, 1 point for appearing at a hearing, with a value per point of € 525.00 and a weighting factor 1.5). According to settled case law, it is assumed that the handling of a case in objection and appeal in principle belongs to the category 'average' with a weighting factor one, unless there are clear reasons that should lead to deviation from this starting point. In this case, the court finds that those reasons are present.The complexity of this case means that the court classifies the case as 'serious' and that means that the weighting factor is set at one and a half in this case.

Decision

The court:

- declares the appeal against the late decision inadmissible;

- declares the appeal against the decision of 16 July 2020 to be well-founded;

- annuls the decision of 16 July 2020 and stipulates that this decision will replace the annulled decision;

- orders the defendant to reimburse the plaintiff the paid court fee of € 354;

- orders the defendant to pay the plaintiff's costs of the proceedings up to an amount of € 1,575.

This statement was made by Mr. JJ Catsburg, chairman, and Mr. PJM Mol and Mr. M. Eversteijn, members, in the presence of Mr. MEC Bakker, registrar. The decision was pronounced on November 23, 2020 and will be made public by publication onrechtspraak.nl.

Registrar Chairman

Copy sent to parties on:

Remedy

An appeal against this decision can be lodged with the Administrative Jurisdiction Division of the Council of State within six weeks of the date on which it was sent.

Appendix

General Administrative Law Act

Article 6: 2

For the application of statutory regulations on objections and appeals, the following are equated with a decision:

[…]

b. failure to take a decision on time.

Article 6:20

[…]

3 The appeal against not taking a decision on time also relates to the decision still taken, unless this fully satisfies the appeal.

General Data Protection Regulation

Article 5

1. Personal data must:

(a) be processed in a way that is lawful, fair and transparent with regard to the data subject ('lawfulness, fairness and transparency'); […}

Article 6

1. Processing is only lawful if and insofar as at least one of the following conditions is met:

a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; b) the processing is necessary for the performance of a contract to which the data subject is a party, or to take measures at the request of the data subject prior to the conclusion of an agreement;

c) the processing is necessary for compliance with a legal obligation incumbent on the controller;

[…]

f) processing is necessary for the pursuit of the legitimate interests of the controller or of a third party, except where the interests or fundamental rights and freedoms of the data subject, which require the protection of personal data, outweigh those interests, in particular when the data subject is a child.

Article 85

1. Member States shall harmonize the right to protection of personal data in accordance with this Regulation with the right to freedom of expression and information, including processing for journalistic purposes and for academic, artistic or literary expression.

2. For processing for journalistic purposes or for academic, artistic or literary expression, Member States shall establish exceptions or derogations from Chapter II (principles), Chapter III (rights of the data subject), Chapter IV (controller and processor) Chapter V (transfer of personal data to third countries or international organizations), Chapter VI (independent supervisory authorities), Chapter VII (cooperation and coherence) and Chapter IX (specific data processing situations) if these are necessary to ensure compliance with the right to protection of personal data with freedom of expression and information.

[…]

Article 83

[…]

8. The exercise by the supervisory authority of its powers under this Article shall be subject to appropriate procedural safeguards in accordance with Union and Member State law, including effective judicial remedy and due process. […].

General Data Protection Regulation Implementation Act

Article 43

1. This Act, with the exception of Articles 1 to 4 and 5, paragraphs 1 and 2, does not apply to the processing of personal data for exclusively journalistic purposes and for the sole purpose of academic, artistic or literary expressions.

[…]

GDPR considerations

(47) The legitimate interests of a controller, including those of a controller to whom the personal data may be disclosed, or of a third party, can provide a legal basis for processing, provided that the interests or fundamental rights and freedoms of the data subject do not override taking into account the reasonable expectations of the data subject based on his relationship with the controller. Such a legitimate interest may exist, for example, where there is a relevant and appropriate relationship between the data subject and the controller, in situations where the data subject is a customer or employed by the controller.In any case, a careful assessment is required to determine whether there is a legitimate interest, as well as to determine whether a data subject can reasonably expect processing for that purpose at the time and in the context of the collection of the personal data. In particular, the interests and fundamental rights of the data subject may outweigh the interest of the controller when personal data are processed in circumstances where the data subjects cannot reasonably expect further processing. Since it is up to the legislator to create the legal basis for processing personal data by public authorities, that legal basis should not apply to processing by public authorities in the performance of their duties.The processing of personal data that is strictly necessary for fraud prevention is also a legitimate interest of the controller in question. The processing of personal data for the purpose of direct marketing can be considered as carried out with a legitimate interest in mind.

1 Consideration 153 to the GDPR, Article 43 of the UAVG.

2 Judgment of the CJEU, 16 December 2008, no. C ‑ 73/07, ECLI: EU: C: 2008: 727.

3 Judgment of the CJEU, 14 February 2019, no. C ‑ 345/17, ECLI: EU: C: 2019: 122.

4 Judgment of the ECtHR, 27 June 2017, No. 931/13, ECLI: CE: ECHR: 2017: 0627JUD000093113.

5 See paragraph 175 of the judgment

6 Judgment of the CJEU, 29 July 2019, no. C-40/17, ECLI: EU: C: 2019: 629.

7 Directive 95/46 / EC of the European Parliament and of the Council of 24 October 1995 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

8 Opinion AG CJEU, 19 December 2018, no. C-40/17, ECLI: EU: C: 2018: 1039.

9 Opinion AG CJEU, 27 January 2017, no. C-13/16, ECLI: EU: C: 2017: 43.

10 Judgment of the CJEU, 9 November 2010, nos. C-92/09 and C-93/09, ECLI: EU: C: 2010: 662, para 77.

11 Judgment of the CJEU, 11 December 2014, no. C-2012/13, ECLI: EU: C: 2014: 2428, paragraph 34.

12 Judgment of the CJEU, 29 January 2008, no. C-275/06, ECLI: EU: C: 2008: 54, paragraph 53.

13 Judgment of the CJEU, 4 May 2017, no. C-13/16, ECLI: EU: C: 2017: 336, paragraph 29.

14 Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46 / EC, Article 29 Data Protection Working Party, 9 April 2-14, p. 24.

15 See, for example, the CJEU judgment on ASNEF, 24 November 2011, nos. C-468/10 and C-469/10, ECLI: EU: C: 2011: 777, para. 48 and judgment on M5A-ScaraA, 11 December 2019, no. C-708/18, ECLI: EU: C: 2019: 1064, paragraph 53.

16 Judgment of the CJEU, 13 May 2014, no. C-131/12, ECLI: EU: C: 2014: 317, para. 73 et seq.