Data Protection Insider, Issue 120

-CJEU Rules on the Sale of Personal Data and Legitimate Interest-

On 4^th October, the CJEU ruled in the case of Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens. In terms of the facts, the case concerned a sports federation (KNLTB – the plaintiff). The federation disclosed its members’ personal data to certain sponsors for remuneration. Certain of the federation’s members then complained, and, as a consequence, the Dutch DPA found the association had infringed Articles 6(1)(a) and (f) GDPR, ‘read in conjunction with Article 5(1)(a)…on the ground that it had disclosed its members’ personal data without their consent and without any legitimate basis for disclosing their data. Consequently, by decision of 20 December 2019, the AP imposed a fine of EUR 525 000 on the KNLTB.’ In this regard, three questions were referred to the CJEU, which the CJEU bundled into one: does Article 6(1)(f) GDPR mean ‘that the processing of personal data which consists in the disclosure, for consideration, of personal data of the members of a sports federation, in order to satisfy a commercial interest of the controller, may be regarded as necessary for the purposes of the legitimate interests pursued by that controller or by a third party’, and does the provision require ‘that such an interest be determined by law?’ In this regard, the CJEU decided that Article 6(1)(f) means ‘the processing of personal data which consists in the disclosure, for consideration, of personal data of the members of a sports federation, in order to satisfy a commercial interest…may be regarded as necessary for the purposes of the legitimate interests pursued by that controller…only on condition that that processing is strictly necessary for the purposes of the legitimate interest in question and that, in the light of all the relevant circumstances, the interests or fundamental rights and freedoms of those members do not override that legitimate interest. While that provision does not require that such an interest be determined by law, it requires that the alleged legitimate interest be lawful’. This case makes essential reading. It deals directly with several questions at the heart of data protection law, including: the degree to which personal data might be commercialised; the scope of the concept of legitimate interest; and the relationship between legal grounds in Article 6. We note, however, that the case is also interesting for the questions it raises/leaves unanswered. For example, whilst the case deals with issues of commercialisation, the court steers clear of direct engagement with themes such as ownership of personal data etc. Equally, whilst the case deals with the concept of legitimate interest, the reader is left wondering what the difference between the concepts of legitimate and legal is. Further, the court suggests that obtaining consent might be a way in which the interests of data subjects might best be protected, and may thus be significant to establishing the utility of Article 6(1)(f) as a legal grounds for processing. If this is the case, however, then why should Article 6(1)(f) be the relevant ground at all – given 6(1)(a) relates to processing on the basis of consent? We recognise this case was decided outside the time-frame for this DPI. The volume of CJEU cases decided in the period covered by the previous issue, however, along with the lower number of cases decided in the past two weeks, led us to the decision to shift coverage to this issue.

-ECtHR On the Balance of Freedom of Expression and Veracity of Information-

On 8^th October, the ECtHR ruled that the domestic courts in Serbia had struck the proper balance between the right to freedom of expression of a Serbian journalist and the right to reputation of a defence lawyer in Kajganic v Serbia. As to the facts of the case, the applicant is a defence lawyer, defending an individual (X) involved in the assassination of the Serbian Prime Minister in 2003. A transcript of the conversation which she held with this person was leaked to a journalist (Y), who covered the story about the assassination. From the leaked conversation Y learned and reported on the deals between the defence lawyer and the institutions of the Serbian State, e.g. the Minister of the Interior. In this conversation ‘the applicant had said that she had secured for X the status of a cooperating witness (…) through “her old buddies”, who were “the two most powerful men in the country”, in exchange for his false testimony in the proceedings’. The defence lawyer requested that her version of the events be published by the same media outlet and the editors published her response. After a long court battle in Serbia, in which Y could not provide the transcripts and the courts unsuccessfully tried to obtain them directly from the authorities which tapped the conversation, the applicant turned to the ECtHR, complaining, amongst other things, about the veracity of the content in the conversation and claimed that her reputation had been damaged by the article written by Y on the topic. The ECtHR observed that ‘Y had published information, obtained from a confidential source, which he had believed to be accurate (…) (and) had complied with his duty of diligence by verifying the information in question (…). The Court further observes that the domestic courts acknowledged the importance of the protection of confidential sources and in this regard they found that ordering a disclosure of source was not justified in the present case (…). They also attempted, on more than one occasion, to obtain a copy of the transcript in question of their own motion from the relevant State bodies, but to no avail (…). They further considered the fact that Y had not contacted the applicant before publishing the article. However, they were satisfied that the applicant had denied the allegations in question and that her denial had been duly published by the same media outlet (…). Lastly, the Court of Appeal also found that the information in question did not divulge any private details (…), but focused on events that could affect the course of criminal proceedings and dealt with matters of public interest (…).’ Hence, the Court concluded that the domestic courts had balanced adequately Y’s right to freedom of expression and the applicant’s right to private life under Article 8 ECHR.

-Updates from the EDPB-

In the past two weeks, the EDPB published the following significant documents:

• 16 October 2024: ‘Guidelines 2/2023 on Technical Scope of Art. 5(3) of ePrivacy Directive’;
• 10^th October 2024: ‘Letter to Kosovan DPA from the Chair of EDPB’ – concerning observer status;
• 9^th October 2024: ‘Statement 4/2024 on the recent legislative developments on the Draft Regulation laying down additional procedural rules for the enforcement of the GDPR’;
• 9^th October 2024: ‘Opinion 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s)’;
• 9^th October 2024: ‘EDPB’s Response to the European Commission Concerning the EDPB work on the interplay between EU data protection and competition law’;
• 9^th October 2024: ‘EDPB Work Programme 2024-2025’;
• 8^th October 2024: ‘Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR’.