The legitimate interests is the most flexible lawful basis for processing, but it cannot be assumed that it will always be the most appropriate. When personal data is used in ways that people would reasonably expect it to be used and were it has a minimal impact on their privacy or a compelling justification exists for the processing.
When the legitimate interests lawful basis is used, extra responsibility for considering and protecting people’s rights and interest apply.
As always, the action should be documented for justification about the why and how the personal data was gathered and processed and, if relevant, the individuals should be informed.
What are legitimate interests?
As stated in Article 6(1)(f), “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”
This can be broken down into a three parts test:
- Purpose: is there a legitimate interest involved?
The legitimate interests can be of either parties involved and they can include commercial interests, individual interests or broader societal benefits.
- Necessity: is the processing necessary for that purpose?
The processing must be a targeted and proportionate way of achieving the main purpose.
- Balancing: do the individual’s interests override the legitimate interest?
There must be a balance between both parties interests. If individual’s would not reasonably expect their data to be used in that way, or if it would cause them unwarranted harm, their interests are likely to prevent the use of this lawful basis.
Client and employee data, marketing fraud preventing, intragroup transfers, and IT security is specifically mentioned in GDPR as legitimate interests. Disclosing information about possible criminal acts or security threats to the authorities is also considered to be a legitimate interest.
When is it applied?
Legitimate interests is the most flexible lawful basis, but it must not be assumed that it will always be the most appropriate for processing.
When choosing the legitimate interests, extra responsibility is implied for ensuring people’s rights and interests are fully considered and protected.
Legitimate interests is most likely to be an appropriate basis when data is used in ways that people would reasonably expect and have a minimal privacy impact. If there is an impact on individuals, this lawful basis may still apply if there is a justification of a more compelling benefit to the processing and the impact is justified.
Public authorities, in particular, can only rely on legitimate interests when processing for a legitimate reason other than performing their tasks as a public authority.
Need Help with GDPR?
Get in touch with us if you need help on the subject.