Commercial, but Legitimate Interest: The Court of Justice Calls the Dutch Data Protection Authority to Order

The ECJ's decision in Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens clarifies the interpretation of 'legitimate interest' under Article 6(1)(f) of the GDPR. The Court found that a purely commercial interest can constitute a legitimate interest, provided that it is lawful and balanced against the rights of data subjects. This directly challenges the restrictive position of the Dutch DPA, which excluded commercial purposes from the scope of legitimate interests. The judgment emphasises that legitimacy does not require a legal basis enshrined in law, but must satisfy the three-part test of legitimate interest. It also highlights the importance of the other two conditions of the test, namely the expectations of data subjects and the absence of less intrusive alternatives. The judgment is an important step towards harmonising the application of the GDPR across Member States, particularly when it comes to balancing commercial interests with the protection of personal data.