Judgment;Summary — ECLI:EU:C:2024:858
Date: 2024-10-04
Language of the case: Dutch
Court formation: Ninth Chamber
Subject matter: Principles, objectives and tasks of the Treaties;Fundamental rights;Data protection;Charter of Fundamental Rights
Procedure: Reference for a preliminary ruling
Origin: Netherlands

Summary C-621/22 – 1 
Case C-621/22 
Summary of the request for a preliminary ruling pursuant to Article 98(1) of 
the Rules of Procedure of the Court of Justice 
Date lodged:  
29 September 2022 
Referring court:  
Rechtbank Amsterdam (Netherlands) 
Date of the decision to refer:  
22 September 2022 
Appellant:  
Koninklijke Nederlandse Lawn Tennisbond 
Respondent:  
Autoriteit Persoonsgegevens 
  
Subject matter of the main proceedings 
The main proceedings concern the appeal lodged by the appellant with the 
Rechtbank Amsterdam (District Court, Amsterdam) against the respondent’s 
decision of 30 July 2020. By that decision, the respondent dismissed as unfounded 
the appellant’s objection to the decision of 20 December 2019 by which it 
imposed a fine of EUR 525 000 on the appellant for breach of the General Data 
Protection Regulation (‘GDPR’).  
Subject matter and legal basis of the request for a preliminary ruling 
The request for a preliminary ruling made under Article 267 TFEU concerns the 
question whether the concept of ‘legitimate interest’ within the meaning of 
Article 6(1)(f) of the GDPR covers only interests enshrined in law (positive test) 
or any interest in so far as that interest is not contrary to the law (negative test) 
and, more specifically, whether a purely commercial interest – such as the interest 
in providing personal data in return for payment without the consent of the data 
EN 
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-621/22 
 
2  
subject concerned – can be regarded as legitimate under certain circumstances 
and, if so, what circumstances are determinative in this regard.  
Questions referred for a preliminary ruling 
1. How should the District Court interpret the term ‘legitimate interest’? 
2. Should the term be interpreted as the respondent interprets it? Are these 
interests which exclusively pertain to the law, constitute law, are enshrined in a 
law? Or; 
3. Can any interest be a legitimate interest, provided that interest is not in 
breach of the law? More specifically: should a purely commercial interest, such as 
the interest at issue here, the provision of personal data in return for payment 
without the consent of the data subject concerned, be regarded as a legitimate 
interest under certain circumstances? If so, what circumstances determine whether 
a purely commercial interest is a legitimate interest? 
Provisions of international and EU law relied on  
European Convention on Human Rights, Article 8. 
Charter of Fundamental Rights of the European Union, Articles 8, 52 and 53. 
Regulation (EU) 2016/679 of the European Parliament and of the Council of 
27 April 2016 on the protection of natural persons with regard to the processing of 
personal data and on the free movement of such data, and repealing Directive 
95/46/EC, Article 6(1)(f).  
Succinct presentation of the facts and procedure in the main proceedings 
1 The appellant is a sports association. Its membership consists of its affiliated 
tennis clubs and their members. The appellant works with sponsors, including the 
Nederlandse Loterij Organisatie BV and SportshopsDirect BV. In 2018, the 
appellant provided the data of some of its association members to these sponsors 
in return for payment, with the sponsors using these data for promotional 
campaigns through mailshots and telemarketing.  
2 Following several reports that the appellant had unlawfully shared personal data 
of its members with the aforementioned sponsors, the respondent launched an 
investigation into the appellant’s compliance with the GDPR. According to the 
respondent, the appellant provided data of its members to the aforementioned two 
sponsors without the members’ consent and without having a lawful basis for 
doing so.  
KONINKLIJKE NEDERLANDSE LAWN TENNISBOND 
 
3 
3 By decision of 20 December 2019, the respondent imposed a fine of EUR 525 000 
on the appellant. The appellant lodged an objection to this. By decision of 30 July 
2020, the respondent declared that objection unfounded. It is against this latter 
decision that the appellant lodged an appeal with the referring court.  
The essential arguments of the parties in the main proceedings 
4 Under the GDPR, personal data may only be processed if there is a basis for such 
processing. Article 6(1) of the GDPR lists these bases exhaustively. There is no 
dispute between the parties that the appellant did not have the consent of its 
members to provide their data to the sponsors. The appellant argues, however, that 
it did have a ‘legitimate interest’ in this regard within the meaning of 
Article 6(1)(f) of the GDPR, which the respondent disputes. The parties are 
therefore divided on the interpretation and scope of the term ‘legitimate interest’.  
5 According to the respondent, there must be a legitimate and therefore concrete 
interest ‘pertaining to the law, constituting law, enshrined in a law’ (positive test).  
In that regard, the respondent states, inter alia, the following:  
– It follows from recital 47 of the GDPR that the processing of the personal data 
of individuals who would not reasonably expect it, cannot be based on a 
legitimate interest. It must entail an interest of the controller which is known in 
advance and which can be taken into account by the data subject. An interest 
that is not sufficiently knowable in advance cannot be a legitimate interest. This 
explanation also finds support in the European Council’s position at the first 
reading of the GDPR.  
– Under Article 52 of the Charter, any limitation on Article 8 of the Charter (right 
to protection of personal data) must be provided for by law and respect the 
essence of that right. It follows from recital 4 of the GDPR that the GDPR in 
fact implements Article 52 of the Charter. In this light, therefore, an interest 
within the meaning of Article 6(1)(f) of the GDPR, which essentially 
constitutes a limitation on the right to protection of personal data, must, at the 
very least, have a bearing on public interest objectives which are recognised by 
the Union or are necessary to protect the rights and freedoms of others.  
– The collection and processing of personal data in order to sell them on without 
the consent of the data subjects concerned violates Article 8 ECHR. If the 
appellant has a legitimate interest, the limitation on Article 8 ECHR is 
established by law, notably in the GDPR. Before the introduction of the GDPR, 
this limitation was not established by law, so the GDPR removes the previously 
existing conflict with Article 8 ECHR. In essence, the appellant’s view means 
that the protection currently provided by the Charter and the GDPR is more 
limited than that provided in the period when only the ECHR applied, which is 
contrary to Article 53 of the Charter.  
SUMMARY OF THE REQUEST FOR A PRELIMINARY RULING – CASE C-621/22 
 
4  
6 According to the appellant, a legitimate interest exists unless that interest is 
contrary to law (negative test).  
A ‘legitimate interest’ need not be traced back to a fundamental right or a legal 
principle. Indeed, it is clear from the GDPR that other interests can also constitute 
a legitimate interest. For example, recital 47 of the GDPR classifies ‘direct 
marketing’ as a legitimate interest. Advocate General M. Bobek, in the Opinion 
relating to the Fashion ID judgment (C-40/17), argues that there is no type of 
interest that is excluded per se. In the same vein, there is Court of Justice case-law 
which recognises a legitimate interest that does not coincide with a fundamental 
right or legal principle (C-131/12, Google Spain). Furthermore, in a judgment of 
23 November 2020, the Rechtbank Midden-Nederland (District Court, Midden-
Nederland) held that a legitimate interest can be established by means of a 
negative test.  
Succinct presentation of the reasoning in the request for a preliminary ruling 
7 According to the referring court, the question whether the appellant has a 
legitimate interest in processing the personal data of its members cannot be 
answered beyond reasonable doubt. The settled case-law of the Court does not 
provide an answer to that question (there is no acte éclairé), nor does 
Article 6(1)(f) of the GDPR provide any guidance on the definition and scope of 
the concept of ‘legitimate interest’ (there is no acte clair). Moreover, this 
provision is not so clearly worded that there can be no doubt as to its 
interpretation and scope.  
8 On the one hand, the referring court refers to the above-mentioned judgment of 
the District Court, Midden-Nederland, which refers to the Opinion of Advocate 
General M. Bobek relating to the Court’s judgment in the Fashion ID case. The 
latter states that Directive 95/46 also does not define or enumerate ‘legitimate 
interests’. He is of the view that this notion is rather elastic and open-ended, that 
no type of interest is excluded per se, provided that it is itself legal, that this 
concept can encompass a range of different interests and that thus not only legal, 
but also all kinds of factual, economic and idealistic interests can constitute a 
legitimate interest. This seems to support the appellant’s position that any interest, 
including a purely commercial interest, can be a legitimate interest. Furthermore, 
the referring court also considers the appellant’s position acceptable because the 
GDPR clearly stipulates when the legal basis of a processing operation must be 
sought in a legal provision.  
9 On the other hand, the referring court states that, when the desire to make money 
from the personal data of others without the consent of the data subjects 
concerned is regarded as a legitimate interest, this seems difficult to reconcile with 
the protection envisaged by the GDPR. In the case of a fundamental right such as 
the right to protection of personal data, the referring court therefore considers the 
respondent’s view to be acceptable. The referring court does note, however, that 
KONINKLIJKE NEDERLANDSE LAWN TENNISBOND 
 
5 
even before the entry into force of the GDPR, a limitation on Article 8 ECHR was 
enshrined in law. Indeed, ‘legitimate interest’ as a basis for processing data was at 
the time included in Article 8(f) of the Wet bescherming persoonsgegevens (Law 
on the Protection of Personal Data).