Legitimate interest and accountability in marketing

Appeal against Belgian DPA decision: important findings on legitimate interest, reasonable expectations and (non-)necessity of verifications of prior lawfulness. In a judgment of yesterday, the Market Court (Brussels Court of Appeal) lifted a reprimand for a company that had used personal data for marketing purposes. The legitimate interest considerations will be of great interest to many, EU-wide.

1. I had the pleasure of representing one company in these proceedings, and we had a nice victory on admissibility: third-party interveners can come in support of one of the parties (the appellant or the Belgian data protection Authority / BDPA) even if they use *other* arguments than that party.

[Background: the BDPA did not include our client within the scope of the initial decision, which we applauded, while the appellant claimed that the BDPA should have done so. We used different arguments than the BDPA and the BDPA even disagreed with one of our arguments on the scope of investigations, but the Market Court (MC) found that this was perfectly OK.]

2. Of broader interest will be the MC’s findings on legitimate interest (LI) & accountability.

a) LI:
As part of a LI assessment, one must examine the extent to which the processing is in line with data subjects’ reasonable expectations.

The Market Court held in this respect (§22) that:
(i) the mere existence of reasonable expectations is insufficient to ensure that a controller’s LI outweighs the interests or the fundamental rights and freedoms of the data subject, yet
(ii) at the same time, the current absence of reasonable expectations (e.g. because there is no contractual relationship with the data subject) does not necessarily mean that the interests or the fundamental rights and freedoms of the data subject outweigh the controller’s LI.

It is “certainly the case” that there is no automatic outweighing of the LI when there is no evidence of an infringement of a fundamental right or freedom of the data subject, when the scope of the relevant processing is more limited, when no special categories of personal data are processed and when the consequences of the processing can be positive for the data subject.

b) Accountability:
Next, the MC – using awkward wording by referring to the “processor” (“verwerker”) instead of “controller” (“verwerkingsverantwoordelijke”) but clearly meaning a controller – states that the Art. 24 GDPR cannot be interpreted as requiring a “processor” (read: controller) who processes data based on legitimate interests to verify the lawfulness of the initial processing where it has received the data from a third party (§27).

This creates some tension vis-à-vis decisions from elsewhere that found that contractual guarantees of lawfulness are insufficient.

3. Conclusion: the MC lifted the reprimand for inadequate rejection of LI as a legal ground by the Belgian DPA (but not on grounds of my client being involved).

Redacted EN machine translation attached.
privacy