CJEU C-621/22 KNLTB: Lawfulness of Commercial Interest Under Art. 6(1)(f)

1. Facts & Preliminary Question

In Case C-621/22, the Royal Dutch Lawn Tennis Association (KNLTB) transmitted personal data of its members to commercial sponsors in return for payment, invoking its commercial legitimate interest. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) held that a purely commercial interest could never qualify as a legitimate interest under Article 6(1)(f) and imposed an administrative fine.

Hearing the reference for a preliminary ruling, the Court of Justice of the European Union delivered its judgment on 4 October 2024 (ECLI:EU:C:2024:858).

2. Legal Scope & Three-Step Test

The Court held that a commercial interest is not excluded as a matter of principle from the concept of legitimate interest under Article 6(1)(f), provided that it is lawful under applicable law. However, this recognition does not automatically make the processing lawful:

• 1. Legitimate aim condition: The interest pursued by the controller or a third party must be lawful (not contrary to law).
• 2. Strict necessity condition: The processing of personal data must be strictly necessary for the purposes of the legitimate interests pursued. Article 6(1)(f) cannot serve as a lawful basis if this strict necessity requirement is unmet or if less intrusive alternatives exist.
• 3. Balancing test: The fundamental rights and freedoms of the data subjects must not take precedence. The controller must strictly account for the reasonable expectations of the data subjects at the time of data collection.

3. Practical Lessons for Data Controllers

The KNLTB judgment does not provide a blank check for commercial monetization of user data. It mandates a documented Legitimate Interest Assessment (LIA) rigorously demonstrating both the strict necessity of the processing and full alignment with data subjects' reasonable expectations.

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework