The Dutch Data Protection Authority, the AP, started an investigation into a specific case of online broadcasted amateur sports games. The investigation led to a sanction of EUR 575,000, but this has now been nullified in a Dutch court (in Dutch, you may need a translator service).
In my personal opinion, this is a bad day for sporting kids in the public domain, for justice in general to see details prevail over underlying intentions and spirit, and for the guts of privacy regulators (DPAs) to start any next fight. Here's why:
This may get a little complicated.
‘VoetbalTV’ is a platform where football soccer (voet = foot, bal = well…. a ball), so, soccer football matches are being broadcasted. The issue is not so much with regards to IP or similar rights. The recordings all pertain to amateur matches, especially with youngsters (yes, mostly minors). The recordings are done professionally and are broadcast-worthy quality wise. 'Smart' camera's that follow the ball are deployed to record the game. broadcasting takes place at large scale online, in return for payment. The initial 'success' was reported with already 20.000 to 25.000 matches recorded in roughly the first year, covering at least around 150.000 individuals.
The issue at court? ‘legitimate interest’. But I get confused more and more when I see what happens in plain view:
The Dutch DPA (AP) is taking too strict a line here. They sanctioned the (now bankrupting) VoetbalTV 575.000 EUR. Reason? ‘legitimate interest’ is not a relevant ground for processing here. The AP states that a ‘legitimate’ interest is only ‘legitimate’ when it finds its origin in the law as a legal interest (the law not being the GDPR itself, but the Dutch legal codex). In other words, if the law doesn’t call something out as a legal interest, it doesn’t fly and the balance test is not even necessary. As per this interpretation, no purely commercial interest could be ‘legitimate’.
Methinks that’s too strict, but in fact it is NOT exactly what the AP pleaded. Actually, they said ‘monetizing personal data does not lead to getting a legitimate interest’ (never confuse cause and effect). Anyway, besides the point, because, then what?
The court disagrees. The fine is nullified, and the court states (correctly IMO) that ‘to exclude beforehand any interest as a legitimate interest contravenes European law.’ That’s right. But it’s not what the AP asked. It also has an adverse effect in jurisprudence. Because?
Reading the details of the sentence is one thing. How this plays out on social media so far seems an entire different thing. Reading between the lines, one could imply that the balance test (LIA - legitimate interest assessment) should be considered a negative one, i.e. ‘if an interest does not contravene the law, it is legitimate’.
Eeehrrmm... NO. If it is in contravention with a law, it's what we call illegal. (again, cause and effect matter, people).
Some schmucks with camera’s can stand by any field where kids are playing a sports game, record it even under a legal loophole exception of ‘we’re journalists, this is journalism’, base the structural processing of audio- and video images of (thousands and thousands and thousands of) mostly minors on ‘legitimate interest’, then broadcast it behind a paywall and monetize the games through pay-per-view or periodic subscriptions… After all, we’re mostly sitting at home, get bored and want to watch sports. Any sports.
Sidenote; this is also NOT what the court was asked to rule about. The AP’s interpretation that lead to the sanction was incorrect in broader view. Case closed. But the ‘schmucks’ now blame the sanction for having led them to a financial abyss, and the ‘victory’ is used to reinstate all. We have yet to see a proper LIA for the original processing, let alone for any second start. (The hobbyist may also have a look here at Recital 81 of the case w Google Spain at the CJEU, published here).
Let’s be clear; the ‘legitimate interest’ ground demands the organization checks to see whether the individual right to privacy may have to prevail over whatever interest the organization thinks it has, before moving forward. When it’s about more individuals, the risk gets bigger. When it’s about I don’t know how many minors playing football matches in amateur games, broadcasted in high res, methinks the right to privacy should have prevailed in this balance test. THAT should be the discussion, not ‘what type of interest may or may not be legitimate’. Sure, the case is closed, but the VoetbalTV initiative seems by misunderstanding these facts suddenly a viable one. Which I don't think it is. Or should be.
Quote, Article 6, paragraph 1, sub f GDPR:
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child (with the addition that “[this] shall not apply to processing carried out by public authorities in the performance of their tasks”).
I don't think anyone needs to be a lawyer to understand the intention behind that....
(EDIT: I already thought it sounded slightly familiar. Must be something with sports in The Netherlands. The same AP ruled earlier with regards to the national tennis aassociation (KNLTB) (PDF alert). Slightly related, they were sanctioned EUR 525.000,- for selling members' personal data of hundreds of thousands of members, without their consent. The KNLTB also found they 'had a legitimate interest' to do so, as the sale was of data to sponsors who then approached the subjects with tennis-related commercial offerings.
I remain hopeful that we will see the commonalities between these and various other cases. 'Privacy' does not exist by the grace of regulations and legal battles alone. Getting paid for something you did not obtain in a reasonably honest way from someone else, is not by definition allowed under 'legitimate interest'. Let the kids play, in freedom.)