Legitimate interest

Introduction

According to the General Data Protection Regulation (GDPR), every processing of personal data must be lawful, including the processing activities carried out by Ad Hoc Data in the context of its services to customers. Such processing must be based on a legal ground as referred to in Article 6(1) of the GDPR. This document specifically focuses on the processing of personal data by Ad Hoc Data in the context of its services, based on legitimate interest within the meaning of Article 6(1)(f) of the GDPR.

The principle is that processing is lawful if it is necessary for the legitimate interests of Ad Hoc Data or a third party, unless the interests, fundamental rights, and freedoms of data subjects override those interests. In this explanation, this legal basis is elaborated according to the three-part test, which requires that (i) a legitimate interest exists, (ii) the processing is necessary, and (iii) the interests are carefully balanced.

This analysis is exclusively concerned with the processing of personal data in the context of Ad Hoc Data’s services, including the recording and making available of personal data in its database. Other processing activities by Ad Hoc Data based on legitimate interest, such as internal processes or marketing activities, are outside the scope of this document. The purpose of this document, in addition to clarifying the balancing of interests conducted by Ad Hoc Data, is also to demonstrate how Ad Hoc Data complies with legal obligations and contributes to a more transparent and fair economic ecosystem.

The personal data processed by Ad Hoc Data have an explicitly business and public character and concern only data relating to enterprises. Part of the data in Ad Hoc Data’s database qualifies as personal data. The processing of personal data by Ad Hoc Data is carried out within a careful legal framework and with extensive safeguards, including transparency and clear contractual arrangements with customers.

Disclaimer regarding this English translation
This document is an English translation of the Legitimate Interest Assessment originally drafted in Dutch. This translation has been provided for the convenience of data subjects. In case of any discrepancies or differences in interpretation, only the Dutch version of the Legitimate Interest Assessment is legally binding and rights may only be derived from the Dutch version.

Assessment of Legitimate Interest (Step 1)

The first step in the three-part test concerns the analysis of the legitimate interests involved in the processing activity (or activities). There must be a current interest in the processing by Ad Hoc Data in order to make this available to its customers. The interest(s) must also be legitimate.

Ad Hoc Data, in the context of its services, processes in its database only personal data that are related to enterprises. Removing personal data from the Ad Hoc Data database would have several negative effects on both business operations and its role in commercial transactions. The relevance and usability of the database would be significantly reduced, as essential personal data, including the names of legal representatives and part of the contact information, would be missing. As a result, Ad Hoc Data’s commercial opportunities would come under significant pressure, especially in comparison to competitors who do provide such data, as its core activity—delivering up-to-date and reliable business information—could no longer be carried out in a comparable manner. The socially relevant role that Ad Hoc Data plays in commercial transactions, contributing to economic transparency and fair competition by making current and relevant data available at an accessible rate, would also be greatly restricted, as the database without personal data would contribute less effectively to a level playing field for enterprises.

It is relevant to note that, according to the case law of the Court of Justice of the European Union, it has been determined repeatedly that a purely commercial interest can also constitute a legitimate interest. Case law of the European Court of Justice1 supports the lawfulness of processing by Ad Hoc Data.

The legitimate interest of Ad Hoc Data

Ad Hoc Data has a direct, own interest in processing personal data relating to enterprises. This interest lies in its core activity: providing customers with up-to-date, reliable, and structured business data about enterprises. By processing this data, Ad Hoc Data can, among other things:

• Operate its business by continuing to provide business services and maintain its competitive position in the market;
• Support its business model by guaranteeing a high-quality and unique data offering;
• Position itself as a reliable partner for business decision-making and the exploration of suitable market segments.

The Legitimate Interest of Ad Hoc Data’s Customers and Third Parties

In addition to Ad Hoc Data’s own interest, the interests of its customers (including potential customers) are also served by Ad Hoc Data’s processing activities. Customers are supported in, among other things:

• Making analyses and choices regarding their business activities, for example by gaining insight into relevant markets, market segments, or (new) target groups for their enterprise based on accurate business information obtained from Ad Hoc Data;
• Obtaining insight into relevant information to make strategic decisions for their enterprise, for example regarding a (newly to be opened) business location;
• Promoting efficient communication and targeted marketing based on up-to-date information about target groups;
• Minimizing business risks through access to reliable data, including the risk that agreements are entered into with parties who are not authorized to act or who provide incorrect information;
• The nature of the data and the way Ad Hoc Data makes data available contribute to broader societal objectives, such as economic transparency, fair competition, and innovation, which in turn are aligned with the broader objectives of the European Union (Article 3 TEU and Article 16 of the Charter);
• Due to the favorable pricing of Ad Hoc Data’s services, it promotes the accessibility of such relevant information for the market, thereby improving access to and competition in the market;
• Complying with legal obligations and expectations (as described, among others, in the GDPR), including keeping personal data processed by Ad Hoc Data in its database accurate, assisting with the removal of personal data of data subjects for whom there is no (longer) a legal basis for processing by means of so-called deduplication lists that Ad Hoc Data provides to all its customers and whose use is enforced through the general terms and conditions;
• Compared to many of its competitors in the data broker market, Ad Hoc Data is highly conscientious and ahead in terms of compliance with legal obligations, including those arising from the GDPR. In this market, Ad Hoc Data is therefore progressive in its business operations and thus fulfills an important (exemplary) role compared to (the rest of) the companies in this market.

The processing of personal data by Ad Hoc Data takes place on the basis of a legitimate interest, where both commercial and functional considerations play a role. For Ad Hoc Data, this interest lies in conducting its business by providing customers with accurate and up-to-date business information in support of their business activities. The processing of personal data relating to enterprises is in line with legal frameworks regarding the use of enterprise data, including Article 2 of the Dutch Trade Register Act. In addition, case law1 shows that commercial interests, under certain conditions, can be considered a legitimate interest, provided that the processing is proportionate and within the reasonable expectations of data subjects.

Necessity Test (Step 2)

The processing of personal data must be necessary for the realization of the legitimate interests. It must be assessed whether these interests cannot reasonably and equally effectively be achieved by other means that are less detrimental to the rights of the data subject, including the application of measures to minimize the impact on data subjects.

Essence of the Processing

Ad Hoc Data focuses on processing data of enterprises, including personal data, which are essential for the provision of its services. The processing of this data is a crucial part of Ad Hoc Data’s core activities and services.

Limitation to Business Purposes

The processing by Ad Hoc Data is strictly aimed at business purposes and is limited to personal data that are essential for the professional activities of enterprises. As a result, the impact on the private lives of data subjects is minimized.

Assessment of Less Intrusive Alternatives

In accordance with the GDPR, Ad Hoc Data has thoroughly examined whether less intrusive alternatives are possible. The conclusions are as follows:

• Fully anonymized data: This alternative is not feasible, as fully anonymized data do not provide the necessary functionalities, such as identifying business target groups, validating business relationships, or verifying representation authority. For Ad Hoc Data, this would present a serious obstacle to providing relevant, reliable, and useful services to its customers and, consequently, to its own functioning in the market.
• Use of only data that cannot be traced back to individuals: Generic data, i.e., data that cannot be traced back to specific persons, lack the precision and reliability necessary for strategic decision-making and effective risk management. Without the possibility to combine these with (directly traceable) personal data, customers of Ad Hoc Data would have difficulty assessing potential business relationships or pursuing other purposes as set out above, significantly reducing the value and effectiveness of the services offered.
• Use of fewer personal data: Ad Hoc Data has already taken significant steps to minimize the processing of personal data, beyond what is common in the market. Unlike many competitors, Ad Hoc Data limits itself to only those personal data strictly necessary for business purposes and only insofar as they are linked to enterprises, and proactively avoids including information that is not essential, such as personal email addresses or personal data not linked to an enterprise. Further reducing personal data, such as excluding data of non-legal entities or names of directors of legal entities, would, however, lead to a serious limitation of the functionality and reliability of the database and thus significantly diminish Ad Hoc Data’s business capabilities and the extent to which its services remain relevant and attractive for (potential) customers.

In all of the above cases, if Ad Hoc Data does not process these data, there is a risk that (potential) customers will obtain comparable or even more extensive personal data via data brokers in countries with less strict privacy legislation. This enables such providers to offer more attractive and relevant services, thereby forming a more appealing alternative for customers. This increases the likelihood of a shift in the market toward such parties, which leads to greater risks for data subjects due to less transparent, less controllable, or even potentially unlawful processing of personal data. This not only entails additional risks for the data subjects themselves but also for the users of such services. Ultimately, this could mean that the data offered by Ad Hoc Data becomes less relevant and attractive for its (potential) customers, with a significant impact on the market and competitive position of Ad Hoc Data as a result.

Data Minimization

Ad Hoc Data has taken extensive measures to limit the processing of personal data as much as possible and processes only data that are necessary for its business services, including:

• Focus on essential data: The processing is primarily aimed at business data, such as company names, business activities, and business contact details. Personal data without business relevance, such as data of natural persons who do not represent an enterprise, are not processed.
• Limitation of data collected: Ad Hoc Data proactively applies limitations to minimize the processing of personal data. Although certain personal data are more widely available through public sources (such as the Trade Register), Ad Hoc Data deliberately chooses not to include these in its database. For example, email addresses with a generic domain name, such as “hotmail.com” or “gmail.com”, are systematically excluded, and Ad Hoc Data in almost all cases limits processing to only one representative per enterprise.
• Limited retention periods: Data (including personal data) are only retained as long as they are relevant for business purposes. When an enterprise ceases to exist or data are otherwise no longer up-to-date, these are removed from the database within a reasonable period. This prevents unnecessary processing.
• Technical and organizational measures: Strict access restrictions, security measures, and advanced technologies ensure that processing is conducted securely and in compliance with the GDPR. In addition, Ad Hoc Data has contractual arrangements with its customers to ensure that they no longer process personal data when Ad Hoc Data, following a request from a data subject, has deleted such personal data. The use of deduplication lists by customers is contractually agreed as a condition for access to the database.

The processing is necessary to achieve the intended purposes. Alternatives, such as the use of fully anonymized data or only data that do not qualify as personal data in themselves, have been examined but have proven insufficiently effective to achieve the same results to an equivalent extent given the purposes and legitimate interests.

Balancing Test (Step 3)

In the balancing test, a weighing of interests is conducted between the legitimate interests for processing by Ad Hoc Data and any infringement by the (intended) processing on the interests, fundamental rights, and freedoms of data subjects, taking into account the specific circumstances of the case, in particular the reasonable expectations of the data subject as well as the scope of the processing and its consequences for those data subjects.

The interests of Ad Hoc Data, its (potential) clients, and the broader economic interest, the interest of legal certainty in commercial transactions, and competition outweigh the limited infringement on the personal privacy of the data subjects. The processing takes place within a professional context and concerns only publicly available, business-related data connected to enterprises, and corresponds to the reasonable expectations of data subjects. In addition, various safeguards are in place to ensure compliance with applicable privacy legislation, such as transparency, data minimization, and organizational and technical security measures. In doing so, Ad Hoc Data goes further than most other comparable market participants in protecting the interests of data subjects.

Conclusion and Final Considerations

The processing of personal data in its database for the purpose of providing services to its clients by Ad Hoc Data is an essential part of its business operations and its mission to promote economic transparency, fair competition, and strategic business decision-making. This processing, based on Article 6(1)(f) of the GDPR, meets legal requirements and is carried out within the legal framework.

By focusing on business data with a public and professional character, Ad Hoc Data minimizes the impact on the rights and freedoms of data subjects. The personal data processed, such as names, functions, and contact information of legal representatives, are indispensable for its services and contribute to the objectives of both Ad Hoc Data and its (potential) clients. Furthermore, the processing supports broader societal legitimate interests (including those of third parties), such as safeguarding economic stability, access to business information, legal certainty in commercial transactions, promoting competition, and access to such information, which are essential for entrepreneurship.

Ad Hoc Data has fulfilled the three elements of the tripartite test. The processing of personal data by Ad Hoc Data is therefore, given the elaboration in the above three steps, necessary for the protection of the legitimate interests of Ad Hoc Data, its (potential) clients, and third parties. The interests, fundamental rights, and freedoms of the data subject(s) that require protection of their personal data do not outweigh these interests in the given circumstances, leading to the conclusion that a legitimate interest exists for the processing of personal data by Ad Hoc Data.

1) 1) The KNLTB judgment (C-621/22) confirms that commercial interests can be regarded as legitimate, provided that the processing is proportionate and takes into account the reasonable expectations of data subjects. Furthermore, the Meta Platforms Ireland judgment (C-252/21) indicates that processing within a professional context, provided it meets legal requirements and is transparent, can fall within the boundaries of legitimate interest.