Published on 07/12/2022 by
– 561 views
Within the EU, data protection authorities sometimes have different approaches on the subject. Some comments, too cautious, continue to circulate. However, the European Commission had signaled the end of recreation from 2020, opposing a restrictive interpretation based on the idea that legitimate interest can never be linked to a commercial purpose. It’s time to re-read the EU executive’s analysis and stop gloating unnecessarily.
It was the authority of the Netherlands who had paid the price for this reframing.
The European Commission first drew attention to judgment C-13/16, Rigas satiksme, in which the CJEU recalled, with regard to Directive 95/46/EC, that the legitimate interest consists of a test in three parts (it has since confirmed the approach under GDPR):
- the establishment of the existence of a legitimate interest at the origin of the processing,
- the assessment of the necessity of the processing in question, and
- balancing in order to establish whether the legitimate interest of the controller outweighs the fundamental rights and freedoms of the data subject.
For the Commission, each element is independent of the others and requires the application of its own criteria.
Regarding “legitimate interest”
In Rigas satiksme, the CJEU considered that the economic interest is legitimate (in this case the interest of a third party to obtain the personal information of a person who damaged his property in order to sue him for damages) .
It also recalls that the Article 29 Working Party had, in its opinion 06/2014 (WP 217), recalled that the notion of legitimate interests includes a “wide” range of interests, and that the freedom to exercise commercial activity, including the pursuit of “purely commercial interests such as the maximization of profits”, is a human right enshrined in Article 16 of the Charter of Fundamental Rights of the European Union (EU Charter ).
The Commission therefore considers that a strict interpretation of legitimate interest, which would in principle exclude commercial purposes, does not make it possible to strike an appropriate balance between the rights in question, since the right to data protection would be systematically given priority that the interest pursued derives from freedom of enterprise.
Turning to the GDPR, the Commission also highlighted Recital 47, from which it follows that processing for direct marketing purposes can be considered to be carried out for a legitimate purpose.
Regarding the necessity of the treatment and the balancing
The European Commission insists on the need to balance concrete, which excludes a rigorous approach in which the commercial purpose is presumed to be unnecessary or disproportionate. It relies in particular on cases C-275/06 (Promusicae), C-468/10 and C-469/10 (ASNEF), C-13/16 (Rigas satiksme), C-131/12 (Google Spain), and C-40/17 (Fashion ID).
As for the criteria to be taken into account in the balancing, they include the nature of the information in question and its sensitivity for the privacy of the person concerned.
It follows from all this, according to the Commission, that it is “not possible to conclude generally that a purely commercial interest is not likely to prevail over the fundamental rights and freedoms of the person concerned, because that must be assessed on the basis of a concrete balancing test”.
Finally, the Commission ends by recalling that the objective of the GDPR “is not to hinder commercial activities but rather to enable business to be conducted while ensuring a high level of data protection”.
More informations ?
By reading the letter from the Commission, available in the appendix.