RvS - 202100045/1/A3

RvS - 202100045/1/A3
Court:	RvS (Netherlands)
Jurisdiction:	Netherlands
Relevant Law:	Article 6(1)(f) GDPR
Decided:	27.07.2022
Published:	27.07.2022
Parties:	VoetbalTV Autoriteit Persoonsgegevens
National Case Number/Name:	202100045/1/A3
European Case Law Identifier:	ECLI:NL:RVS:2022:2173
Appeal from:	Rb. Midden-Nederland (Netherlands) UTR 20/2315
Appeal to:	Unknown
Original Language(s):	Dutch
Original Source:	Rechtspraak (in Dutch)
Initial Contributor:	Eva Lu

The Dutch Council of State confirmed the lower court's annulment of the Dutch DPA's decision in the VoetbalTV case. The DPA's decision, which both courts found insufficiently motivated, had received attention because of its strict interpretation of legitimate interest.

English Summary

Facts

VoetbalTV (the controller) is a collaboration between the Royal Dutch Football Association and Talpa Network. The online platform allowed fans to (re)watch and analyze professional video footage of football matches played by amateur players (the data subjects). VoetbalTV based its processing activities on a legitimate interest.

Decision by the DPA

The Dutch DPA investigated Voetbal TV in 2019 and imposed a fine of €575.000 for processing personal data without a legal basis. The DPA held that VoetbalTV had a purely commercial interest, which can never be legitimate interest pursuant to Article 6(1)(f) GDPR. The DPA followed that a legitimate interest should (1) stem from a legal provision, (2) be worthy of protection and (3) have an urgent nature.

According to the DPA, a purely commercial interests was not specific enough and lacked an urgent legal nature. VoetbalTV appealed this decision at the District Court.

Decision by the District Court

The court found that the DPA gave a wrong interpretation of legitimate interest. It noted that having a purely commercial interest does not exclude a legitimate interest. The further held that the DPA did not sufficiently substantiate its decision. It should have investigated all the interests of VoetbalTV and weigh them against the violation of the privacy of those involved.

Therefore, the Court held that the DPA should not have issued the fine and annulled the decision (see: UTR 20/2315). The DPA appealed this decision at the Council of State.

Appeal at the Council of State (the case at hand)

During the appeal, the DPA stood by its strict interpretation of legitimate interest. The DPA argued that the District Court misconstrued the concept of legitimate interest, as a legitimate interest must follow from the law. It repeated that VoetbalTV's interest was purely commercial which does not qualify as a legitimate interest as this is not an interest provided for by law.

The DPA substantiated this by saying that interpreting legitimate interest in a broader sense seemed illogical in light of the objective pursued by the GDPR and even conflicts with the interpretation of Article 8 ECHR. Even if VoetbalTV had a legitimate interest, the processing was still unnecessary and balancing the interests at stake would have been in favor of the data subjects according to the DPA.

The DPA also requested prejudicial questions, as the CJEU had not given an opinion on the topic of a solely commercial interest as a legitimate interest.

VoetbalTV argued that a legitimate interest is an interest that is not in conflict with the law and that the DPA wrongly labelled its interest as purely commercial. VoetbalTV argued that the platform also (1) enhanced the involvement and enjoyment of fans, (2) facilitated technical analyses by trainers and analysts, and (3) offered players, friends and family the possibility to watch or review the matches remotely.

Holding

The Council of State agreed with the District Court that the DPA gave a wrong interpretation of the concept of legitimate interest. The Council of State noted that to successfully rely on legitimate interest as a legal basis, three conditions must be met pursuant to the FashionID case: a legitimate interest, necessity and a balancing test.

The Council held that the organization that processes the personal data indicates what its interest are and why processing is necessary for that purpose. The DPA must then test that interest against the FashionID criteria.

The Council held that VoetbalTV's interest were not purely commercial in nature. The DPA wrongly disregarded the other interests that VoetbalTV put forward during its assessment. In addition, the Council held that the DPA neglected to assess whether the processing was necessary and weigh the interests of VoetbalTV against those of the players.

The Council held that the DPA failed to perform the three-step test completely and the decision was therefore insufficiently motivated. The Council noted that because it had been established that the interests in question were not purely commercial in nature, the question whether an exclusively commercial interest could in itself be a legitimate interest did not need answering. Hence no prejudicial question was required.

The Council of State held that the appeal lodged by the DPA was unfounded and the judgement under appeal must be upheld.

Comment

VoetbalTV went bankrupt in September 2020, partly because of the ongoing proceedings (according to Talpa Network, see press release).

The Dutch DPA maintains a very strict interpretation of the concept of legitimate interest. This would result in several processing activities being prohibited, except for consent of the data subject. This interpretation was critisized by many, including the European Commission which sent a letter to the DPA about their concerns.

Unfortunately the Council of State did not assess whether a purely commercial interest could be a legitimate interest. However, reading between the lines, one could argue that the Council was of the opinion that it can be. For example, the Council affirmed the District Court's statement that the test for legitimate interest is to see whether it was not prohibited. A purely commercial interest would pass that test.

Further Resources

Press release of the Council of State: https://www.raadvanstate.nl/@132264/geen-boete-voor-voetbaltv/

Press release of Talpa Network: https://talpanetwork.com/pers/corporate/failliet-voetbaltv-wint-rechtszaak-van-autoriteit-persoonsgegevens

The Dutch DPA did not comment on the decision.

English Machine Translation of the Decision

The decision below is a machine translation of the Dutch original. Please refer to the Dutch original for more details.

20100045/1/A3.

Judgment date: July 27, 2022

DEPARTMENT

ADMINISTRATIVE JURISDICTION

Decision on the appeal of:

the Dutch Data Protection Authority (hereinafter: the AP),

appellant,

against the judgment of the Midden-Nederland District Court of 23 November 2020 in case no. 20/2315 in the proceedings between:

Football TV B.V. (hereinafter: VoetbalTV)

and

the AP.

Process sequence

By decision of July 16, 2020, the AP imposed a fine of € 575,000.00 on VoetbalTV for the unlawful processing of personal data.

By decision of 23 November 2020, the court declared the appeal lodged by VoetbalTV not to make a timely decision inadmissible, declared the appeal lodged by VoetbalTV against the decision of 16 July 2020 well-founded, annulled that decision and determined that this decision replaces the annulled decision. This statement is attached.

The AP has appealed against this decision.

VoetbalTV has given a written explanation.

VoetbalTV has filed a conditional incidental appeal.

The AP has submitted an opinion.

VoetbalTV has submitted a further piece.

The Division dealt with the case in court on May 23, 2022, where the AP, represented by E. Nijhof and O.S. Nijveld, assisted by mr. T.N. Sanders and mr. M.H.L. Hemmer, both lawyers in Rotterdam and Breda respectively, and VoetbalTV, represented by [Agent A], and [Agent B], shareholder, assisted by mr. Q.R. Kroes, lawyer in Amsterdam, have appeared.

Considerations

Introduction

1.       VoetbalTV was founded on July 17, 2018. It is an initiative of the Royal Dutch Football Association (hereinafter: KNVB) in collaboration with the media company Talpa Network B.V, both of which hold 50% shares in this joint venture. VoetbalTV is a video platform for amateur football and makes video registrations of matches in amateur football on behalf of football clubs. At the beginning of 2020, 153 football clubs participated in VoetbalTV and about 2,500 to 3,000 matches were recorded and broadcast monthly. In addition, VoetbalTV is a social platform. The VoetbalTV app is estimated to be used by 520,000 people. On the VoetbalTV platform you can watch football moments, analyze matches, collect data and share it with others. Our own editorial team also collects 'highlights' such as goals and chances and displays them. In addition, trainers/analysts can use an analysis tool.

The registration and distribution of the video images by VoetbalTV is a processing of the personal data of (underage) athletes to which the General Data Protection Regulation (EU) 2016/679 (hereinafter: AVG) applies. VoetbalTV is the controller as referred to in Article 4, preamble and under 7, of the GDPR for this processing of personal data.

2.       The AP has investigated the privacy of players and spectators. This investigation has led to a draft investigation report dated May 15, 2019 and, after an opinion procedure, to a final investigation report dated November 6, 2019. It concludes that VoetbalTV unlawfully processes personal data. The AP has subsequently issued an intention to proceed with enforcement. Because there was no decision to do so, VoetbalTV - after notice of default - lodged an appeal with the court. On July 16, 2020, the AP made a substantive decision. VoetbalTV has lodged an appeal against this.

Decision

3.       In that decision, the AP imposed a fine on VoetbalTV in the amount of € 575,000.00 because it unlawfully processed personal data. The processing is not necessary for the representation of the legitimate interests of the controller or of a third party, which do not comply with Article 6, first paragraph, preamble and under f, of the GDPR. The processing of VoetbalTV does not (exclusively) serve a journalistic purpose. The AP further concludes that the interest of VoetbalTV in structurally making video recordings of large numbers of amateur football matches, their further distribution via the VoetbalTV app and further use/distribution via the analysis tools for the football clubs, does not qualify as justified. The AP furthermore states that VoetbalTV also does not comply with the second and third steps that are part of the assessment against Article 6(1)(f) of the GDPR. Now that this processing cannot be based on another legal basis as referred to in Article 6(1) of the GDPR, the AP concludes that the processing has taken place in violation of the GDPR. The AP believes that this is a serious violation, which justifies a large fine.

Attacked verdict

4.       The court has ruled that VoetbalTV no longer has an interest in an assessment of its appeal against the late decision.

The court has further ruled that the recording of the football matches and the broadcasting thereof to the public does not in this case serve solely a journalistic purpose. The journalistic exception therefore does not apply to the data processing involved in this procedure.

The court has further ruled that the assessment of the AP in this case is based on a wrong interpretation of the concept of 'legitimate interest' and is therefore contrary to Article 6, first paragraph, opening words and under f, of the GDPR. The case law of the Court of Justice of the European Union does not provide a clear description of what exactly a legitimate interest is and the interpretation of the AP that - in short - it should concern a legal interest, is therefore not regarded as a legal interest in that case law. to be found in such a way. This explanation is also not in line with the opinion of the Working Group on Article 29 (WP29, the predecessor of the European Data Protection Board) from 2014, and with the view of Advocate General M. Bobek, who stated in his conclusion to the judgment on Fashion ID of 29 July 2019, no. C-40/17, ECLI:EU:C:2019:629, states that this is an open flexible concept. In addition, it follows from the case law of the Court of Justice of the European Union that Member States are not free to exclude in advance or categorically invoking the legitimate interest for certain categories of processing. The court is of the opinion, partly on the basis of foreign translations of this concept, that a negative test applies. This test means that the processor may not pursue an interest that is in conflict with the law; it must be a legitimate interest. According to the court, VoetbalTV itself must assert its legitimate interest and must act accordingly. The processing may not be in conflict with the law and also not go beyond its statutory purpose, in other words: not be in conflict with the law. Taking into account consideration 47 of the GDPR (e.g. direct marketing), the AP will have to assess whether it is necessary to process personal data on the basis of the goals set by VoetbalTV. That didn't happen. The investigation on which the fine is based stopped with the determination that VoetbalTV has no legitimate interest and the necessity has not been discussed. Nor has the conflicting rights and interests at stake been weighed up. In view of this, the decision has not been taken with sufficient care and is therefore contrary to Section 3:2 of the General Administrative Law Act (hereinafter: Awb). Therefore, the fine cannot be sustained. Pursuant to Article 8:72a of the Awb, the District Court saw reason to provide for the case itself, in the sense that it does not take another decision in place of the annulled decision. The fine is therefore completely off the table, according to the court.

Legal framework

5.       The relevant regulations are included in the appendix that forms part of the ruling.

Appeal of the AP

Is there a conflict with Article 6:20, fourth paragraph, of the Awb?

6.       The AP argues that the court wrongly did not reject the appeal for handling as an objection. This is contrary to Article 6:20(4) of the Awb and the system of that Act. This is all the more true now that the court has ruled that due care defects are associated with the decision of 16 July 2020, which can be remedied in an objection.

6.1. By decision of July 16, 2020, the AP imposed a fine on VoetbalTV. Since the appeal against the failure to take a decision in time also relates to the decision still taken and the decision of 16 July 2020 does not fully meet the appeal, this appeal will, in view of Article 6:20, paragraph 3, of the Awb, deemed to include an appeal against this decision. It follows from the fourth paragraph of this provision, read in conjunction with Article 7:1(1) of the Awb, that in a situation such as this the court may refer an appeal to the administrative authority to be treated as an objection. The court has a certain freedom to give substance to this power. Article 7:1a of the Awb also offers the option of direct appeal. This is based on the consent of the parties.

6.2. In a letter to the court dated 22 July 2020, the AP has stated that it will refer to the court's judgment with regard to the assessment of whether Article 6:20, paragraph 3, of the General Administrative Law Act is applied. This does not show any objections from the AP against the substantive treatment of the decision of 16 July 2020 by the court. The statement of defense submitted to the court by the AP on 1 October 2020 also requested that the appeal be declared unfounded. It follows from the minutes of the court hearing that both parties intended to skip the objection phase. This has been confirmed by both parties upon request.

Under these circumstances, the court was able to decide not to refer the legal appeal of VoetbalTV against the decision of 16 July 2020 to the AP for handling as an objection.

This argument fails.

Legitimate interest, Article 6(1)(f) GDPR

7.       According to the AP, a "legitimate interest" is an interest that follows from the law and not, as VoetbalTV - and the court agreed with it in the contested decision - believe that "legitimate interest" is any interest that does not conflict with the law. In doing so, the court misinterpreted the concept of "legitimate interest". According to the AP, there is no legitimate interest in this, in view of a grammatical, legal historical and legal systematic interpretation. The importance of VoetbalTV is purely commercial in nature. With its activities, VoetbalTV only serves a commercial interest. Partly in view of the purpose of the GDPR, it is not logical to interpret this term broadly. Moreover, this would also conflict with the interpretation of Article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms (hereinafter: ECHR), which must also guarantee privacy. The Court of Justice has not yet commented on this point. The AP therefore requests the Division to ask preliminary questions. If there is already a legitimate interest, then according to the AP, the processing is also not necessary. Moreover, the balancing of interests must be in favor of the players.

7.1. For a successful reliance on Article 6, first paragraph, preamble and under f, of the GDPR, three conditions must be met. This follows from, inter alia, the judgment on Fashion ID of 29 July 2019, no. C-40/17, ECLI:EU:C:2019:629, in which the Court of Justice explains Article 7(f) of Directive 95 /46, which is substantively identical to Article 6, first paragraph, preamble and under f, of the GDPR. The first step is that the interest that VoetbalTV pursues is a legitimate interest. If so, it must then be assessed whether the processing of the personal data is necessary for the representation of that legitimate interest (the second step). This involves testing against proportionality and subsidiarity: is the infringement for the data subjects in proportion to the purpose to be served by the processing and can the purpose be achieved in a way that is less detrimental to the data subjects? The third step is that the interests of the controller and those involved must be weighed up.

7.2. According to Article 6(1)(f) of the GDPR, it must be established in a case such as this that the processing is necessary for the purposes of the legitimate interests pursued by the controller or a third party, except where the interests or fundamental rights and the fundamental freedoms of the data subject which require the protection of personal data outweigh those interests, in particular where the data subject is a child.

7.3. The AP takes the position that VoetbalTV has no legitimate interest in this case, because its interest is purely commercial in nature. This is not an interest laid down in the law and therefore cannot be qualified as justified. VoetbalTV wants to earn money by processing images of random (underage) amateur football players who have not given permission for this themselves. According to the AP, there is no right to earn money with the personal data of others. According to the AP, the test therefore ends at the first step.

VoetbalTV argues that the AP has wrongly classified its interest as purely commercial. It has stated that its interest in the processing of the personal data lies in a. increasing the involvement and enjoyment of football fans, including that of players who are portrayed, b. being able to perform technical analyzes for/by trainers and/or analysts of the football clubs and third parties and c. offering the opportunity to, among others, players, friends and family members to be able to watch matches remotely, for example if they cannot be physically present. In addition, VoetbalTV has a channelization function, because it contributes to a higher level of privacy protection, among other things because it prevents the recording of matches via other channels.

8.       It is up to the controller to determine what the interest is in the processing, why that processing is necessary and that he must act accordingly. It is up to the AP to assess what the controller actually does, to see whether stated interests correspond to this and are actually represented by the processing and whether these are justified. In the opinion of the Division, this test should take place in step 1 and the court therefore rightly considered it this way. The court ruled that in this case, in view of the other interests mentioned by VoetbalTV, which are not of a commercial nature, there is no question of a purely commercial interest. There is therefore no need to answer the question whether an exclusively commercial interest in itself can be a legitimate interest within the meaning of Article 6(1), opening words and (f) of the GDPR. When assessing the first condition, the AP wrongly did not take into account the interests stated by VoetbalTV, as stated above under 7.2. Given the nature of VoetbalTV's activities - making images of football matches and making them available to third parties, including those who want to be portrayed - the processing of personal data is necessary for more than just the commercial interests of VoetbalTV. The AP has therefore established on incorrect grounds that VoetbalTV has acted in violation of Article 6, first paragraph, preamble and under f, of the GDPR.

9.       It follows from the foregoing that an answer to the question raised by the AP is not necessary for the assessment of this case. Having regard to the judgments of the Court of Justice of 6 October 1982, Cilfit, ECLI:EU:C:1982:335, paragraph 10, and of 6 October 2021, Consorzio Italian Management, ECLI:EU:C:2021:799, paragraph 34 , there is no reason to refer questions for a preliminary ruling.

10.     It further follows from the foregoing that in its assessment the court rightly stopped at step 1. The AP did not sufficiently investigate steps 2 and 3, so that the fine imposed cannot be upheld. In this case regarding a fine, partly in view of what has been considered under 6.2 above, the Division sees no reason to rule that - as the AP has argued on appeal - the court should have offered the AP the opportunity to rectify the lack of the decision. from July 16, 2020.

Conclusion on the appeal of the AP

11.     The foregoing means that the appeal of the AP is unfounded. The impugned verdict must be affirmed.

Conditional incidental appeal by VoetbalTV

12. VoetbalTV has filed an incidental appeal under the condition that the appeal lodged by the AP is well-founded. Because this appeal is unfounded, this condition has not been met and the Division does not arrive at a substantive assessment of the cross-appeal of VoetbalTV.

13.     The AP must reimburse legal costs.

Decision

The Administrative Jurisdiction Division of the Council of State:

I.        confirms the attacked statement;

II. condemns the Dutch Data Protection Authority to pay compensation for at VoetbalTV B.V. costs incurred in connection with the handling of the appeal up to an amount of € 1,518.00;

III. determines that a court fee of € 541.00 is levied from the Dutch Data Protection Authority.

Adopted by mr. E.J. Daalder, chairman, and mr. C.C.W. Lange and mr. W. den Ouden, members, in the presence of mr. B. Ley-Nell, registrar.

w.g. descender

chair

The Registrar is prevented from signing the judgment

Pronounced in public on July 27, 2022

597



APPENDIX | LEGAL FRAMEWORK



General Administrative Law Act

Article 6:20

[-]

3. The appeal against the failure to make a decision in time also relates to the decision taken as yet, unless this fully satisfies the appeal.

4. The decision on the appeal may, however, be referred to another body where an objection or appeal against the decision taken as yet is pending, or may or could be made or lodged.

Article 7:1a

1. In the notice of objection, the person submitting the objection may request the administrative authority to agree to a direct appeal to the administrative court, in derogation from Article 7:1.

General Data Protection Regulation

Article 4

For the purposes of this Regulation:

1) personal data: any information about an identified or identifiable natural person (the data subject); an identifiable natural person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more elements characteristic of the physical, physiological, genetic, psychological, economic, cultural or social identity of that natural person;

[…]

Article 6

1. Processing is only lawful if and insofar as at least one of the following conditions is met:

a) the data subject has consented to the processing of his/her personal data for one or more specific purposes;

b) the processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract;

c) the processing is necessary for compliance with a legal obligation to which the controller is responsible;

[...]

f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where the interests or fundamental rights and freedoms of the data subject which require the protection of personal data outweigh those interests, in particular when the person concerned is a child.

Implementation Act General Data Protection Regulation

Article 43

1. This Act, with the exception of Articles 1 to 4 and 5, paragraphs 1 and 2, does not apply to the processing of personal data for exclusively journalistic purposes and for exclusively academic, artistic or literary forms of expression.

[...]

GDPR Considerations

(47) The legitimate interests of a controller, including those of a controller to whom the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or

the fundamental rights and freedoms of the data subject do not override, taking into account the data subject's reasonable expectations based on his relationship with the controller. Such a legitimate interest may

for example, be present where there is a relevant and appropriate relationship between the data subject and the controller, in situations where the data subject is a customer or employed by the controller. In any case, a careful assessment is required to determine whether there is a legitimate interest,

as well as to determine whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing can take place for that purpose. In particular, the interests and fundamental rights of the data subject may override the interests of the controller where personal data are processed in circumstances where the data subjects cannot reasonably be further

expect processing. Since it is up to the legislator to create the legal basis for personal data processing by public authorities, that legal ground should not apply to processing by public authorities in the performance of their tasks. The processing of personal data that is strictly necessary for

fraud prevention is also a legitimate interest of the controller in question. The processing of personal data for the purpose of direct marketing can be regarded as carried out with a view to a legitimate interest.