Netherlands

[NL] Dutch Court annuls GDPR fine imposed on streaming platform VoetbalTV for distributing sports content to large audiences

IRIS 2021-1:1/23

Jurriaan van Mil

Institute for Information Law (IViR)

On 23 November 2020, the District Court of Midden-Nederland (Rechtbank Midden-Nederland - the Court) annulled the decision of the Dutch Data Protection Authority (Autoriteit Persoonsgegevens - DDPA) to impose a EUR 575 000 administrative fine on VoetbalTV, a streaming platform for amateur football. Most importantly, the Court found that the DDPA had erred, ruling that the commercial processing of personal data does not categorically exclude a legitimate interest in that processing under the General Data Protection Regulation (Algemene Verordening Gegevensbescherming - GDPR).

Following a regulatory investigation, the dispute materialised on 16 July 2020, when the DDPA decided to impose a EUR 575 000 administrative fine on VoetbalTV for the unlawful processing of personal data. According to the DDPA, VoetbalTV had no legal basis to record a large number of amateur football matches and distribute those recordings to a large audience (Article 6(1) GDPR). The DDPA substantiated the conclusion by holding that the commercial processing of personal data categorically excludes a legitimate interest in that processing (Article 6(1)(f) GDPR). More generally, the DDPA accused VoetbalTV of infringing the principle of lawfulness (Article 5(1)(a) GDPR).

As a preliminary matter, the Court considered whether VoetbalTV could successfully invoke the journalistic exception (Article 85 GDPR; Article 43 Uitvoeringswet Algemene Verordening Gegevensbescherming), rendering most of the GDPR inapplicable. Even though commercial purposes can coincide with journalistic purposes, the Court rejected the appeal, ruling that recordings of amateur football matches are not newsworthy enough.

As the crux of the matter, the Court considered whether a commercial interest in the processing of personal data could be considered a legitimate interest (Article 6(1)(f) GDPR). While the DDPA argued that a legitimate interest has to be specified as a legal interest in legal rules or legal principles, VoetbalTV argued that a legitimate interest must not be contrary to the law. Following an overview of European case law and supervision, the Court sided with VoetbalTV, ruling that the commercial processing of personal data does not categorically exclude a legitimate interest in that processing.

However, the Court added that two other conditions had to be satisfied as well. The processing of personal data needed to be necessary to attain the interests of VoetbalTV, and a balance needed to be struck between the interests of VoetbalTV and the people who were recorded by the streaming platform. According to the Court, the DDPA had not considered these conditions sufficiently, meaning that the fine had to be annulled.

In conclusion, the judgment sets an important precedent, namely that commercial interests can be considered legitimate interests under the GDPR; it contains notable principles for the application of the GDPR to audiovisual recordings and to the online distribution of sports content.