Technology News Update
25 October 2024
In this News Update, we discuss preliminary questions referred to the Supreme Court on the order button in webshops, as well as questions referred to the CJEU on personalised advertising and on whether a commercial interest can be a legitimate interest in personal data processing. Finally, we discuss the Dutch DPA's warning that data breach victims often receive insufficient information.
Court of Justice rules that a commercial interest can be a legitimate interest
On 4 October 2024, the Court of Justice of the European Union (CJEU) answered questions referred for a preliminary ruling in proceedings between the Royal Dutch Lawn Tennis Association (Koninklijke Nederlandse Lawn Tennis Bond) and the Dutch Data Protection Authority (Dutch DPA). In its judgment, the CJEU ruled that the Dutch DPA's much-criticised interpretation that a purely commercial interest can never be a legitimate interest is incorrect. The CJEU stated that a commercial interest can be a legitimate interest, provided that it is not contrary to the law. Other requirements for successful reliance on the legitimate interest basis are that the processing is necessary and that the controller's legitimate interest is not overridden by the data subject's privacy interests.
Parallel to this judgment, on 9 October 2024 the European Data Protection Board (EDPB) published guidelines on the use of legitimate interest as a legal processing basis, for consultation purposes. The consultation period runs until 20 November 2024.
Court of Justice puts significant restrictions on the use of personal data for targeted advertising on social network platforms
On 4 October 2024, the CJEU gave an important judgment in proceedings between Meta Platforms and Max Schrems about the processing of personal data for targeted advertising purposes on social network platforms. The CJEU ruled that the GDPR's data minimisation principle implies that social network platforms must not aggregate, analyse and use personal data for targeted advertising without restriction as to time and without distinction as to type of data. This applies both to data obtained from the data subject and to data obtained from third parties on or outside the platform. According to the Court, the indiscriminate use of all of the personal data held by a social network platform for targeted advertising purposes is therefore inconsistent with the GDPR.
Dutch DPA warns that data breach victims often receive insufficient information
On 5 September 2024, the Dutch DPA published a report on warning notices sent out after a data breach. In its report, the Dutch DPA concludes that organisations generally provide insufficient information to victims when notifying them of the data breach. According to the Dutch DPA, the warning notices are usually not clear, take a long time to reach the victims and do not state the consequences of the data breach, or do so insufficiently. The Dutch DPA published a number of examples of those notices and announced that it intends to monitor their quality more strictly.
Read more (in Dutch)
Supreme Court clarifies requirements applicable to webshop order buttons
On 4 October 2024, the Supreme Court answered questions referred to it for a preliminary ruling on webshop order buttons. In a dispute between Bol.com and a consumer who had not paid for an order, the Supreme Court ruled that a webshop order button stating only 'place order', 'order' or 'complete order' does not meet the requirements of the Dutch Civil Code. Briefly stated, Article 6:230v(3) of the Dutch Civil Code provides that a website's ordering process must be configured in such a way that it is clear to the consumer that the order creates an obligation to pay.
According to the Supreme Court, it cannot be assumed that the mere use of the text 'place order', 'order' or 'complete order' will lead the average consumer to conclude that an obligation to pay will arise. Consequently, the consumer can nullify the agreement.
While we believe it ought to be clear to consumers that placing an order in a webshop logically entails that this order must also be paid for, based on this Supreme Court judgment it would be advisable for webshops to review their order pages and order buttons.
Read more (in Dutch)
