CJEU, judgment of 4 October 2024, C-621/22, Koninklijke Nederlandse Lawn Tennisbond

1 Overview

The Netherlands tennis association transmitted personal data of its members, for consideration, to two sponsors, one of them a gambling operator, which then sent advertising to the members. The Netherlands data protection authority imposed a fine. The association relied, among other things, on Article 6(1)(f) GDPR. The Amsterdam District Court referred to the CJEU the question whether a purely commercial interest can be a legitimate interest within the meaning of that provision.

2 Headnotes

A commercial interest of the controller may in principle be a legitimate interest within the meaning of Article 6(1)(f) GDPR, provided that it is not unlawful. What is decisive is an assessment in the individual case which takes account of the applicable legal environment (paras. 40, 49).

Necessity is to be assessed narrowly: the processing is necessary only where the interest cannot reasonably be achieved by less intrusive means (paras. 42 et seq., 51 et seq.).

The balancing exercise must take into account not only the immediate effects but also possible wider risks, for example where the data are transmitted to a gambling operator and this may entail risks of gambling addiction for the data subjects (para. 56).

3 Significance

The decision makes clear that a purely economic motive may qualify as a legitimate interest, while at the same time remaining bound by the strict standard of necessity and balancing established in the case law of the CJEU. It is also a practical example of the fact that secondary consequential harm (here, health risks arising from gambling advertising) must likewise be factored into the balancing exercise.