A recent judgment of the Court of Justice of the European Union might prove to serve a purpose the parties and the Court surely did not have in mind: it could help resolve some dilemmas concerning the data protection laws of Montenegro and Bosnia & Herzegovina (“BiH“), neither of which is an EU member state.
The ruling of 4 October 2024, in the case Koninklijke Nederlandse Lawn Tennisbond (“KNLT“) v. Autoriteit Persoonsgegevens, is significant because it confirms that a data controller’s commercial interests can qualify as “legitimate interests”, a distinct legal basis for the processing of personal data under Article 6.1(f) of the General Data Protection Regulation (“GDPR“). But data protection practitioners in Montenegro and BiH should take note of the Court’s clarification that “while [Article 6.1(f)] does not require that such an interest be determined by law, it requires that the alleged legitimate interest be lawful”.
The quoted part helps to interpret the headache-inducing wording in the provisions analogous to Article 6.1(f) of the GDPR, found in the data protection laws of the two Balkan countries. In essence, the KNLT judgment supports the view that these laws recognize “legitimate interests” as a legal basis for data processing, and that those interests do not need to be determined by law.
“Interest based on law” (Montenegro) and “lawful interest” (BiH)
The matter is complicated because of the wording in the relevant provisions of the Montenegrin and BiH data protection laws. In Montenegro, the provision states that “personal data may be processed without the consent of the data subject when processing is necessary … for the purposes of an interest based on law pursued by the data controller or by the third party” (Article 10.2(5)). In BiH, the relevant part of the provision allows data processing necessary for “the protection of lawful rights and interests exercised by the data controller or a third party ” (Article 6.1(e)). The key question is: what constitutes an interest “based on law” in Montenegro, and what qualifies a “lawful” interest in BiH?
There is a tendency among legal practitioners in the region to interpret “interest based on law” and even “lawful interest” restrictively, to require the interest to be enshrined in and determined by specific legislation. Examples from the decisions of the Montenegrin data protection authority illustrate this approach: job applicants may obtain data about the selected candidate based on provisions of the administrative proceedings act recognising the right to review files in administrative proceedings and the right to legal remedy; a person can obtain data about the salary of a professor at the State university under a law on the salaries of civil servants and public employees; or, a political party may obtain details on electoral register changes based on the law on the electoral register.
Unintended restrictive wording?
Given the origin of the quoted provisions in the Montenegrin and BiH data protection laws, it is doubtful that the legislatures in these countries deliberately intended to reject the EU’s approach on the crucial issue of the legal bases for processing of personal data. Despite the ambiguous wording in both laws, it seems reasonable to interpret them as incorporating the concept of legitimate interest.
The data protection laws in BiH and Montenegro predate the adoption of the GDPR and are based on the earlier EU framework, Directive 95/46/EC. Adopted in 2005 and 2012 respectively, these laws contain provisions on the legal bases for processing personal data that closely mirror Article 7 of the Directive, which in turn is very similar to the current Article 6 of the GDPR. As a result, both the Montenegrin and BiH laws list the same standard legal bases for the processing: consent, conclusion or performance of a contract, legal obligation, vital interests, public interest, and legitimate interests.
It is unlikely that on the specific issue of the legitimate interests, the lawmakers wanted to depart from the EU’s data protection instrument (Directive 95/46/EC). The general approach in Montenegro and BiH has been to align their national laws to those in the EU, as a part of the effort to get closer to EU membership.
An indication that there was no intent to diverge is the English language version of the Montenegrin law, available on the website of the Data Protection Agency. In this version, the legal basis is translated as “legitimate interest”, rather than “an interest based on a law” as the text in Montenegrin is worded (na zakonu zasnovan interes).
As for BiH, the wording in the local language version is in any event “lawful interest”, and not “an interest based on a law”. The phrase “lawful interest” may be reasonably interpreted as meaning, simply, “not contrary to the law”, without requiring a specific law to authorise the interest.
In sum: It is likely that the lawmakers in the two countries thought that they were faithfully implementing the Directive’s rule on legitimate interest into their domestic legal system. The use of different terms, such as “interest based on law” in Montenegro and “lawful interest” in BiH, may simply be the result of poor translation which went unnoticed. Or, those involved in the process of the laws’ enactment may have believed that the term “legitimate interest” in the Directive meant the same as the terms used in the national laws.
The KNLT judgment dispenses with the understanding that “legitimate” requires stipulation in a law
Assuming that the lawmakers in Montenegro and BiH indeed desired to transpose the Directive’s concept of “legitimate interest” into the national legal systems, these two countries are now in the same position as the EU member states: all have received from the EU’s top court an authoritative clarification that the legitimate interest does not have to be enshrined in and determined by law. Instead, “interest based on law” in Montenegro and “lawful interest” in BiH mean that the interest may not be contrary to the law.
However, some in Montenegro may continue to argue that their country’s law has deliberately departed from Directive 95/46/EC, by purposefully discarding the concept of “legitimate interest” and opting for differing concept of an interest based on law. That interpretation is difficult to reconcile with the rationale behind the law, including the provision on the legal bases of the processing (Article 10), and with the English-language translation of the law on the website of the Data Protection Agency which employs the term “legitimate interest”. Therefore, the burden of proving that the legislature indeed pursued a contrary and restrictive approach is on the proponents of this view.
In BiH, anyone who would similarly advocate a contrarian and restrictive approach would face an ever more daunting task to support their position. The term used in the Bosnian data protection law for the interest – “lawful interest” – does not on its face require the interest to be enshrined in a law. Moreover, the Bosnian data protection agency has approved the registration of records of processing activities where “lawful interest” was cited as the legal basis, without referring to any specific law that would determine such interest (for example here and here). That is consistent with the interpretation of “legitimate interest” in the Court of Justice’s KNLT judgment.
Photo by Shubham Dhage on Unsplash
