European Union: Issued Judgement of the CJEU on the lawsuit regarding GDPR violations on customer data consent (Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens) (C-621/22)

On 4 October 2024, the Court of Justice of the European Union (CJEU) delivered a judgment regarding the interpretation of Article 6(1)(f) of Regulation (EU) 2016/679 (GDPR) concerning the processing of personal data. The judgement is the Court's answer to a request for a preliminary judgement on a dispute between the Koninklijke Nederlandse Lawn Tennisbond (KNLTB), a sports federation, and the Autoriteit Persoonsgegevens (Data Protection Authority of the Netherlands). The KNLTB faced a fine for allegedly unlawfully disclosing the personal data of its members to sponsors without their consent or a legitimate basis. The KNLTB brought an action, arguing that disclosing members' personal data was justified by a legitimate interest, namely by enhancing the association's relationship with its members and offering discounts through sponsors, while the Data Protection Authority contended that legitimate interests must be defined by law. The District Court of Amsterdam had referred several questions to the Court of Justice for a preliminary ruling, seeking clarification on what constitutes a "legitimate interest" under the GDPR. The court clarified that the concept of legitimate interest can encompass the commercial interests of organisations, while emphasising that such processing must not only be lawful but also strictly necessary for the legitimate interest pursued, and that the fundamental rights and freedoms of the data subjects must not be overridden.