EDPB Issues Guidelines on Legitimate Interest for Data Processing
The European Data Protection Board (EDPB) has adopted new guidelines regarding the processing of personal data based on legitimate interests. These guidelines are currently open for public consultation, which will conclude on 20 November 2024.
The guidelines analyze the criteria established in Article 6(1)(f) of the General Data Protection Regulation (GDPR) that data controllers must satisfy to lawfully process personal data under the legitimate interest provision. They also reflect on a recent ruling by the Court of Justice of the European Union (CJEU) concerning the Dutch Data Protection Authority’s decision regarding the Royal Tennis Association, affirming that legitimate interests may encompass purely commercial motivations.
The EDPB emphasizes that Article 6(1)(f) should not be viewed as a blanket authorization for all data processing activities that do not fit within other legal bases outlined in Article 6(1) of the GDPR. It is crucial to interpret this provision restrictively. Only interests that are lawful, clearly articulated, real, and present can be deemed legitimate. For instance, legitimate interests may arise when the individual is a client or in the service of the data controller, as noted in the EDPB’s press release.
Furthermore, the necessity of processing personal data must be assessed against the principle of data minimization. The guidelines clarify that legitimate interests do not take precedence over individuals’ rights and freedoms. They provide practical examples to help organizations conduct the necessary balancing exercise in various contexts.
Prof. Dr. Louisa Specht-Riemenschneider, Germany’s newly appointed Federal Commissioner for Data Protection and Freedom of Information, has welcomed the guidelines, highlighting their potential to enhance legal certainty for both citizens and businesses. The guidelines assert that relying on legitimate interest as a legal basis for data processing should not be considered a last resort nor should it be misapplied merely because it appears less restrictive than other legal bases.
