Joke Bodewits and Chantal Dam of Hogan Lovells write:
The European Commission (EC) has proactively reached out to the Dutch Data Protection Authority (DPA) to criticize its interpretation of legitimate interest under the GDPR. The criticism is in response to enforcement actions and guidance issued by the Dutch DPA in which it states that data processing for purely commercial interests can never be based on a company’s legitimate interests. The EC views that this interpretation is too strict and conflicts with the GDPR, case law of the EU Court of Justice and guidance of the Article 29 Working Party (WP29) and European Data Protection Board (EDPB). In fact, the EC considers this interpretation to hamper business activities, as it severely limits businesses’ possibilities of processing personal data for commercial interests. The EC has invited the Dutch DPA to change its views, but so far, the Dutch DPA indicated that it stands by its position.
Read more at Engage