Skip to main content
Praxikon

Ruling

EU Court of Justice in KNLTB: a purely commercial interest can be a legitimate interest

Date
Status
final
Body
Hof van Justitie van de Europese Unie
Reference
C-621/22, ECLI:EU:C:2024:858

What it is about

On questions from the Amsterdam District Court in the KNLTB fine case (disclosure of members' data to sponsors for payment), the Court held that a controller's commercial interest can be a legitimate interest under Article 6(1)(f) GDPR, provided it is not contrary to law. The interest need not be laid down in law but must be lawful. The processing must also be strictly necessary and the data subjects' interests and fundamental rights must not override it in light of all circumstances. The Court thereby rejected the Dutch DPA's view that a legitimate interest must be enshrined in law.

What this means in practice

You cannot simply rely on legitimate interest for marketing or data sales, but it is not excluded up front either. Document the three step test: which interest, why strictly necessary, and why data subjects' interests do not override it. Without that record and clear information to data subjects the basis will not hold.

The GDPR articles concerned

Source: EUR-Lex, arrest van het Hof van 4 oktober 2024, C-621/22checked on 15 September 2026

Summary and practical reading by Praxikon. Not legal advice; the source prevails.

Connections

What connects to this development

Case law

Guidelines

Enforcement and fines8 of 9

Legislation in motion