RvS - 202100045/1/A3
From GDPRhub
| RvS - 202100045/1/A3 | |
|---|---|
 | |
| Court: | RvS (Netherlands) |
| Jurisdiction: | Netherlands |
| Relevant Law: | Article 6(1)(f) GDPR |
| Decided: | 27.07.2022 |
| Published: | 27.07.2022 |
| Parties: | VoetbalTV Autoriteit Persoonsgegevens |
| National Case Number/Name: | 202100045/1/A3 |
| European Case Law Identifier: | ECLI:NL:RVS:2022:2173 |
| Appeal from: | Rb. Midden-Nederland UTR 20/2315 |
| Appeal to: | Unknown |
| Original Language(s): | Dutch |
| Original Source: | Rechtspraak (in Dutch) |
| Initial Contributor: | Eva Lu |
The Dutch Council of state held that the Dutch DPA had imposed a fine of €575,000 on VoetbalTV on incorrect grounds (no legitimate interest), as the DPA interpreted the meaning of legitimate interest as ´an interest that follows from the law´ when this is ´any interest that is not contrary to the law.´ The DPA could therefore not establish whether there was a legitimate interest.
English Summary
Facts
VoetbalTV (controller) is a video and social platform where football matches of amateur players (data subjects) are recorded on behalf of amateur football clubs. It allows users to watch matches, collect data, analyze and share them. VoetbalTV is an initiative of the Royal Dutch Football Association (KNVB) in cooperation with media company Talpa Network. Following an investigation, the DPA imposed a fine of €575,000 on the controller for the unlawful processing of personal data. The controller appealed this decision at the District Court, which annulled the decision, including the fine (see: UTR 20/2315). The DPA then appealed this decision at the Coucil of State.
The DPA stated that the Court misconstrued the concept of legitimate interest, as this is an interest that follows from the law and not, as the controller and the District Court believe, any interest that is not contrary to the law. The controller's interest was purely commercial according to the DPA. In view of a grammatical, historical and systematic interpretation of the law, the controller had no legitimate interest as this is not an interest provided for by law. The DPA requested prejudicial questions, as the CJEU had not given an opinion on the topic of legitimate interest as a solely commercial interest.
Moreover, the DPA argued that it was not logical to interpret legitimate interest broadly in light of the objective pursued by the GDPR and that this would conflict with the interpretation of Article 8 ECHR. Even if there was a legitimate interest, the DPA was of opinion that the processing was not necessary, and that the balancing of interests should be in favor of the data subjects.
The controller argued that its interests were not purely commercial. The processing activities had several purposes, including (1) the enhancement of the involvement of football fans, (2) the ability to perform analyses and (3) offering the possibility for users to rewatch matches. In addition, VoetbalTV has a channeling function which prevents the recording of matches through other channels.
Holding
The Council of State noted that it was for the controller to decide the interest and necessity of processing, and that it must act accordingly. The DPA must then assess what the controller actually did and whether it corresponded with its stated interests. Furthermore, the DPA has to assess whether the processing is justified.
The Council of state held that this test should have taken place in the DPA's assessment of the controller, in accordance with the District Court's ruling. It also agreed that the controller's interest was not purely commercial, considering the other interests mentioned by the controller. In view of the nature of the activities of the controller - making images of football matches and making these available to third parties, including those who wish to be filmed - the processing of personal data is necessary for more than just the commercial interests of the controller. The DPA therefore determined on incorrect grounds that the controller acted in violation of Article 6(1)(f). Therefore, the DPA was wrong not to consider these additional interests. As the DPA already neglected this, the question of whether an exclusively commercial interest can in itself be a legitimate interest did not need answering. Hence no prejudicial question were required.
The Council of State held that the appeal lodged by the DPA was unfounded and the judgement under appeal must be upheld.
Comment
Share your comments here!
Further Resources
Share blogs or news articles here!
English Machine Translation of the Decision
The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.
20100045/1/A3. Judgment date: July 27, 2022 DEPARTMENT ADMINISTRATIVE JURISDICTION Decision on the appeal of: the Dutch Data Protection Authority (hereinafter: the AP), appellant, against the judgment of the Midden-Nederland District Court of 23 November 2020 in case no. 20/2315 in the proceedings between: Football TV B.V. (hereinafter: VoetbalTV) and the AP. Process sequence By decision of July 16, 2020, the AP imposed a fine of € 575,000.00 on VoetbalTV for the unlawful processing of personal data. By decision of 23 November 2020, the court declared the appeal lodged by VoetbalTV not to make a timely decision inadmissible, declared the appeal lodged by VoetbalTV against the decision of 16 July 2020 well-founded, annulled that decision and determined that this decision replaces the annulled decision. This statement is attached. The AP has appealed against this decision. VoetbalTV has given a written explanation. VoetbalTV has filed a conditional incidental appeal. The AP has submitted an opinion. VoetbalTV has submitted a further piece. The Division dealt with the case in court on May 23, 2022, where the AP, represented by E. Nijhof and O.S. Nijveld, assisted by mr. T.N. Sanders and mr. M.H.L. Hemmer, both lawyers in Rotterdam and Breda respectively, and VoetbalTV, represented by [Agent A], and [Agent B], shareholder, assisted by mr. Q.R. Kroes, lawyer in Amsterdam, have appeared. Considerations Introduction 1. VoetbalTV was founded on July 17, 2018. It is an initiative of the Royal Dutch Football Association (hereinafter: KNVB) in collaboration with the media company Talpa Network B.V, both of which hold 50% shares in this joint venture. VoetbalTV is a video platform for amateur football and makes video registrations of matches in amateur football on behalf of football clubs. At the beginning of 2020, 153 football clubs participated in VoetbalTV and about 2,500 to 3,000 matches were recorded and broadcast monthly. In addition, VoetbalTV is a social platform. The VoetbalTV app is estimated to be used by 520,000 people. On the VoetbalTV platform you can watch football moments, analyze matches, collect data and share it with others. Our own editorial team also collects 'highlights' such as goals and chances and displays them. In addition, trainers/analysts can use an analysis tool. The registration and distribution of the video images by VoetbalTV is a processing of the personal data of (underage) athletes to which the General Data Protection Regulation (EU) 2016/679 (hereinafter: AVG) applies. VoetbalTV is the controller as referred to in Article 4, preamble and under 7, of the GDPR for this processing of personal data. 2. The AP has investigated the privacy of players and spectators. This investigation has led to a draft investigation report dated May 15, 2019 and, after an opinion procedure, to a final investigation report dated November 6, 2019. It concludes that VoetbalTV unlawfully processes personal data. The AP has subsequently issued an intention to proceed with enforcement. Because there was no decision to do so, VoetbalTV - after notice of default - lodged an appeal with the court. On July 16, 2020, the AP made a substantive decision. VoetbalTV has lodged an appeal against this. Decision 3. In that decision, the AP imposed a fine on VoetbalTV in the amount of € 575,000.00 because it unlawfully processed personal data. The processing is not necessary for the representation of the legitimate interests of the controller or of a third party, which do not comply with Article 6, first paragraph, preamble and under f, of the GDPR. The processing of VoetbalTV does not (exclusively) serve a journalistic purpose. The AP further concludes that the interest of VoetbalTV in structurally making video recordings of large numbers of amateur football matches, their further distribution via the VoetbalTV app and further use/distribution via the analysis tools for the football clubs, does not qualify as justified. The AP furthermore states that VoetbalTV also does not comply with the second and third steps that are part of the assessment against Article 6(1)(f) of the GDPR. Now that this processing cannot be based on another legal basis as referred to in Article 6(1) of the GDPR, the AP concludes that the processing has taken place in violation of the GDPR. The AP believes that this is a serious violation, which justifies a large fine. Attacked verdict 4. The court has ruled that VoetbalTV no longer has an interest in an assessment of its appeal against the late decision. The court has further ruled that the recording of the football matches and the broadcasting thereof to the public does not in this case serve solely a journalistic purpose. The journalistic exception therefore does not apply to the data processing involved in this procedure. The court has further ruled that the assessment of the AP in this case is based on a wrong interpretation of the concept of 'legitimate interest' and is therefore contrary to Article 6, first paragraph, opening words and under f, of the GDPR. The case law of the Court of Justice of the European Union does not provide a clear description of what exactly a legitimate interest is and the interpretation of the AP that - in short - it should concern a legal interest, is therefore not regarded as a legal interest in that case law. to be found in such a way. This explanation is also not in line with the opinion of the Working Group on Article 29 (WP29, the predecessor of the European Data Protection Board) from 2014, and with the view of Advocate General M. Bobek, who stated in his conclusion to the judgment on Fashion ID of 29 July 2019, no. C-40/17, ECLI:EU:C:2019:629, states that this is an open flexible concept. In addition, it follows from the case law of the Court of Justice of the European Union that Member States are not free to exclude in advance or categorically invoking the legitimate interest for certain categories of processing. The court is of the opinion, partly on the basis of foreign translations of this concept, that a negative test applies. This test means that the processor may not pursue an interest that is in conflict with the law; it must be a legitimate interest. According to the court, VoetbalTV itself must assert its legitimate interest and must act accordingly. The processing may not be in conflict with the law and also not go beyond its statutory purpose, in other words: not be in conflict with the law. Taking into account consideration 47 of the GDPR (e.g. direct marketing), the AP will have to assess whether it is necessary to process personal data on the basis of the goals set by VoetbalTV. That didn't happen. The investigation on which the fine is based stopped with the determination that VoetbalTV has no legitimate interest and the necessity has not been discussed. Nor has the conflicting rights and interests at stake been weighed up. In view of this, the decision has not been taken with sufficient care and is therefore contrary to Section 3:2 of the General Administrative Law Act (hereinafter: Awb). Therefore, the fine cannot be sustained. Pursuant to Article 8:72a of the Awb, the District Court saw reason to provide for the case itself, in the sense that it does not take another decision in place of the annulled decision. The fine is therefore completely off the table, according to the court. Legal framework 5. The relevant regulations are included in the appendix that forms part of the ruling. Appeal of the AP Is there a conflict with Article 6:20, fourth paragraph, of the Awb? 6. The AP argues that the court wrongly did not reject the appeal for handling as an objection. This is contrary to Article 6:20(4) of the Awb and the system of that Act. This is all the more true now that the court has ruled that due care defects are associated with the decision of 16 July 2020, which can be remedied in an objection. 6.1. By decision of July 16, 2020, the AP imposed a fine on VoetbalTV. Since the appeal against the failure to take a decision in time also relates to the decision still taken and the decision of 16 July 2020 does not fully meet the appeal, this appeal will, in view of Article 6:20, paragraph 3, of the Awb, deemed to include an appeal against this decision. It follows from the fourth paragraph of this provision, read in conjunction with Article 7:1(1) of the Awb, that in a situation such as this the court may refer an appeal to the administrative authority to be treated as an objection. The court has a certain freedom to give substance to this power. Article 7:1a of the Awb also offers the option of direct appeal. This is based on the consent of the parties. 6.2. In a letter to the court dated 22 July 2020, the AP has stated that it will refer to the court's judgment with regard to the assessment of whether Article 6:20, paragraph 3, of the General Administrative Law Act is applied. This does not show any objections from the AP against the substantive treatment of the decision of 16 July 2020 by the court. The statement of defense submitted to the court by the AP on 1 October 2020 also requested that the appeal be declared unfounded. It follows from the minutes of the court hearing that both parties intended to skip the objection phase. This has been confirmed by both parties upon request. Under these circumstances, the court was able to decide not to refer the legal appeal of VoetbalTV against the decision of 16 July 2020 to the AP for handling as an objection. This argument fails. Legitimate interest, Article 6(1)(f) GDPR 7. According to the AP, a "legitimate interest" is an interest that follows from the law and not, as VoetbalTV - and the court agreed with it in the contested decision - believe that "legitimate interest" is any interest that does not conflict with the law. In doing so, the court misinterpreted the concept of "legitimate interest". According to the AP, there is no legitimate interest in this, in view of a grammatical, legal historical and legal systematic interpretation. The importance of VoetbalTV is purely commercial in nature. With its activities, VoetbalTV only serves a commercial interest. Partly in view of the purpose of the GDPR, it is not logical to interpret this term broadly. Moreover, this would also conflict with the interpretation of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (hereinafter: ECHR), which must also guarantee privacy. The Court of Justice has not yet commented on this point. The AP therefore requests the Division to ask preliminary questions. If there is already a legitimate interest, then according to the AP, the processing is also not necessary. Moreover, the balancing of interests must be in favor of the players. 7.1. For a successful reliance on Article 6, first paragraph, preamble and under f, of the GDPR, three conditions must be met. This follows from, inter alia, the judgment on Fashion ID of 29 July 2019, no. C-40/17, ECLI:EU:C:2019:629, in which the Court of Justice explains Article 7(f) of Directive 95 /46, which is substantively identical to Article 6, first paragraph, preamble and under f, of the GDPR. The first step is that the interest that VoetbalTV pursues is a legitimate interest. If so, it must then be assessed whether the processing of the personal data is necessary for the representation of that legitimate interest (the second step). This involves testing against proportionality and subsidiarity: is the infringement for the data subjects in proportion to the purpose to be served by the processing and can the purpose be achieved in a way that is less detrimental to the data subjects? The third step is that the interests of the controller and those involved must be weighed up. 7.2. According to Article 6(1)(f) of the GDPR, it must be established in a case such as this that the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where the interests or fundamental rights and the fundamental freedoms of the data subject which require the protection of personal data outweigh those interests, in particular where the data subject is a child. 7.3. The AP takes the position that VoetbalTV has no legitimate interest in this case, because its interest is purely commercial in nature. This is not an interest laid down in the law and therefore cannot be qualified as justified. VoetbalTV wants to earn money by processing images of random (underage) amateur football players who have not given permission for this themselves. According to the AP, there is no right to earn money with the personal data of others. According to the AP, the test therefore ends at the first step. VoetbalTV argues that the AP has wrongly classified its interest as purely commercial. It has stated that its interest in the processing of the personal data lies in a. increasing the involvement and enjoyment of football fans, including that of players who are portrayed, b. being able to perform technical analyzes for/by trainers and/or analysts of the football clubs and third parties and c. offering the opportunity to, among others, players, friends and family members to be able to watch matches remotely, for example if they cannot be physically present. In addition, VoetbalTV has a channelization function, because it contributes to a higher level of privacy protection, among other things because it prevents the recording of matches via other channels. 8. It is up to the controller to determine what the interest is in the processing, why that processing is necessary and that he must act accordingly. It is up to the AP to assess what the controller actually does, to see whether stated interests correspond to this and are actually represented by the processing and whether these are justified. In the opinion of the Division, this test should take place in step 1 and the court therefore rightly considered it this way. The court ruled that in this case, in view of the other interests mentioned by VoetbalTV, which are not of a commercial nature, there is no question of a purely commercial interest. There is therefore no need to answer the question whether an exclusively commercial interest in itself can be a legitimate interest within the meaning of Article 6(1), opening words and (f) of the GDPR. When assessing the first condition, the AP wrongly did not take into account the interests stated by VoetbalTV, as stated above under 7.2. Given the nature of VoetbalTV's activities - making images of football matches and making them available to third parties, including those who want to be portrayed - the processing of personal data is necessary for more than just the commercial interests of VoetbalTV. The AP has therefore established on incorrect grounds that VoetbalTV has acted in violation of Article 6, first paragraph, preamble and under f, of the GDPR. 9. It follows from the foregoing that an answer to the question raised by the AP is not necessary for the assessment of this case. Having regard to the judgments of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, paragraph 10, and of 6 October 2021, Consorzio Italian Management, ECLI:EU:C:2021:799, paragraph 34 , there is no reason to refer questions for a preliminary ruling. 10. It further follows from the foregoing that in its assessment the court rightly stopped at step 1. The AP did not sufficiently investigate steps 2 and 3, so that the fine imposed cannot be upheld. In this case regarding a fine, partly in view of what has been considered under 6.2 above, the Division sees no reason to rule that - as the AP has argued on appeal - the court should have offered the AP the opportunity to rectify the lack of the decision. from July 16, 2020. Conclusion on the appeal of the AP 11. The foregoing means that the appeal of the AP is unfounded. The impugned verdict must be affirmed. Conditional incidental appeal by VoetbalTV 12. VoetbalTV has filed an incidental appeal under the condition that the appeal lodged by the AP is well-founded. Because this appeal is unfounded, this condition has not been met and the Division does not arrive at a substantive assessment of the cross-appeal of VoetbalTV. 13. The AP must reimburse legal costs. Decision The Administrative Jurisdiction Division of the Council of State: I. confirms the attacked statement; II. condemns the Dutch Data Protection Authority to pay compensation for at VoetbalTV B.V. costs incurred in connection with the handling of the appeal up to an amount of € 1,518.00; III. determines that a court fee of € 541.00 is levied from the Dutch Data Protection Authority. Adopted by mr. E.J. Daalder, chairman, and mr. C.C.W. Lange and mr. W. den Ouden, members, in the presence of mr. B. Ley-Nell, registrar. w.g. descender chair The Registrar is prevented from signing the judgment Pronounced in public on July 27, 2022 597 APPENDIX | LEGAL FRAMEWORK General Administrative Law Act Article 6:20 [-] 3. The appeal against the failure to make a decision in time also relates to the decision taken as yet, unless this fully satisfies the appeal. 4. The decision on the appeal may, however, be referred to another body where an objection or appeal against the decision taken as yet is pending, or may or could be made or lodged. Article 7:1a 1. In the notice of objection, the person submitting the objection may request the administrative authority to agree to a direct appeal to the administrative court, in derogation from Article 7:1. General Data Protection Regulation Article 4 For the purposes of this Regulation: 1) personal data: any information about an identified or identifiable natural person (the data subject); an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more elements characteristic of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person; […] Article 6 1. Processing is only lawful if and insofar as at least one of the following conditions is met: a) the data subject has consented to the processing of his/her personal data for one or more specific purposes; b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract; c) the processing is necessary for compliance with a legal obligation to which the controller is responsible; [...] f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh those interests, in particular when the person concerned is a child. Implementation Act General Data Protection Regulation Article 43 1. This Act, with the exception of Articles 1 to 4 and 5, paragraphs 1 and 2, does not apply to the processing of personal data for exclusively journalistic purposes and for exclusively academic, artistic or literary forms of expression. [...] GDPR Considerations (47) The legitimate interests of a controller, including those of a controller to whom the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject do not override, taking into account the data subject's reasonable expectations based on his relationship with the controller. Such a legitimate interest may for example, be present where there is a relevant and appropriate relationship between the data subject and the controller, in situations where the data subject is a customer or employed by the controller. In any case, a careful assessment is required to determine whether there is a legitimate interest, as well as to determine whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing can take place for that purpose. In particular, the interests and fundamental rights of the data subject may override the interests of the controller where personal data are processed in circumstances where the data subjects cannot reasonably be further expect processing. Since it is up to the legislator to create the legal basis for personal data processing by public authorities, that legal ground should not apply to processing by public authorities in the performance of their tasks. The processing of personal data that is strictly necessary for fraud prevention is also a legitimate interest of the controller in question. The processing of personal data for the purpose of direct marketing can be regarded as carried out with a view to a legitimate interest.
