CJEU Clarifies Limits Of "Legitimate Interest" Under GDPR For Commercial Data Processing

The Court of Justice of the European Union (CJEU) addressed how organisations can rely on the "legitimate interest" basis under the GDPR when processing personal data for commercial purposes, such as marketing, without user consent. The CJEU clarified that a controller's commercial interest may be necessary for the legitimate interest pursued by that controller.

The dispute arose from the actions of the Royal Dutch Lawn Tennis Association (KNLTB) sharing member data with sponsors for marketing without consent, resulting in a €525,000 fine from the Dutch Data Protection Authority (AP) for GDPR violations. KNLTB argued its "legitimate interest" in engaging members with promotional offers justified the data use. Following an appeal, the Amsterdam District Court sought clarification from the CJEU on whether selling member data for direct marketing without consent aligns with GDPR's "legitimate interest" clause.