Court decision · 4 October 2024
Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens
Case C-621/22, ECLI:EU:C:2024:857 · Court of Justice of the European Union
What it means for your code
Legitimate interests is available for commercial purposes but it is a three-step test you have to document; write the balancing assessment before shipping the feature, not after the complaint.
What happened
A tennis association sold its members' contact details to sponsors and relied on legitimate interests. The Dutch authority took the view that a purely commercial interest could never qualify.
What was decided
A purely commercial interest can be a legitimate interest, provided it is lawful, the processing is genuinely necessary for it, and the balancing against the data subjects' rights and reasonable expectations comes out in the controller's favour.
The legal test applied
- A purely commercial interest can be a legitimate interest if it is lawful
- The processing must be strictly necessary for that interest with no less intrusive means
- The balancing turns on the data subjects' reasonable expectations in the circumstances
What would have changed the outcome
- Members who were told at sign-up that details would be shared with sponsors expect it; members who were not, do not
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.