I would put it in the business layer, after all this is business logic that we are talking about. Stored procedures can of course be used to pull back the appropriate data, but I am not a fan of implementing decision logic solely in the database. If nothing else just because it becomes harder and harder to track what is going on when revisiting the code later on.