Legitimate interests – updated guidance

In our previous article on legitimate interests, we explained what “legitimate interests” are under Article 6(1) (f) of the GDPR and when they apply. In this article, we revisit the requirements relating to this lawful basis, considering the guidance from the European Data Protection Board (“EDPB”) adopted on 8^th October 2024. For those of you who would prefer a quick read, rather than reading the guidance in full, the EDPB has also issued a summary.

Draft guidelines

The most recent guidance is in draft form and was open for public consultation until 20^th November 2024. It builds on the initial guidance issued by the Article 29 Working Party back in 2014, by explaining the requirements in more detail and adding a section on the contextual application of Article 6(1)(f) GDPR.

The basics

As explained in our previous article, when processing personal data, there must be a lawful basis for doing so. Article 6 of the GDPR makes provisions for six different lawful bases, one of which is legitimate interests. In order to rely on this, the following three criteria need to be satisfied:

1. The Purpose Test

The purpose test involves identifying a “legitimate” interest is and, whilst this is not defined within the legislation, the EDPB has confirmed in the latest guidance that an interest may be legitimate if it is:

• Lawful and
• Clearly and precisely articulated and
• Real and present (not speculative)

Importantly, the legitimate interest may be pursued by the controller or a third party.

2. The Necessity Test

If it can be established that there is a legitimate interest in the processing in the first instance, the next step is to consider whether the processing is “necessary”. The EDPB states that if there are other reasonable ways to achieve the same outcome that are just as effective but less intrusive, then the processing would not be regarded as “necessary”.

3. The Balancing Test

Assuming the first two tests have been satisfied, the third and final test requires balancing the interests of the controller (or third party) against the interests, rights and freedoms of the data subjects. This means considering, not just the data subjects’ interests, but also their right to data protection and privacy, right to liberty and security, freedom of expression and information, freedom of thought, conscience and religion, freedom of assembly and association, prohibition of discrimination, the right of property and the right to physical and mental integrity either directly or indirectly (which could include a “chilling effect” such as where data subjects refrain from expressing their views for fear of legal action).

In conducting the balancing exercise, the impact on the data subjects needs to be assessed taking into account the following:

• the nature of the data to be processed
• the context of the processing
• any further consequences of the processing and
• the reasonable expectations of the data subjects

The requirement is not to remove ALL impact on data subjects, but to ensure that any impact is not disproportionate and, if it is, then the processing should not proceed on the basis of legitimate interests. Controllers need to be especially careful when children’s personal data is being processed, since the EDPB’s view is that the interests of children will “very often” outweigh the interests of the controller or third parties.

Data subject rights

The EDPB guidance stresses the importance of ensuring that data subjects’ rights are protected, emphasising the need to be transparent with data subjects about how their personal data is processed and to clearly explain what the controller’s (or third party’s) legitimate interests are. The EDPB also highlights the requirement for controllers to facilitate all data subjects’ rights.

Contextual application

The draft guidance adds numerous use case examples including:

• Processing of children’s personal data
• Processing by public authorities
• Processing for the purposes of preventing fraud
• Processing for the purposes of direct marketing
• Processing for the purposes of internal administrative purposes within a group of undertakings
• Processing for the purposes of ensuring network and information security
• Transmission of personal data to competent authorities

The above provides welcome clarification on the scenarios in which Article 6(1)(f) GDPR can be relied upon.

Case law

The draft guidance is aligned with the recent decision of the Courts of Justice of the European Union (“CJEU”) Koninklijke Nederlandse Lawn Tennisbond v Autoriteit Persoonsgegevens (C-621/22), in which it was confirmed that a “purely commercial interest” can be regarded as a legitimate interest and, therefore, fulfilling the first test referred to above. In other words, it is possible for the Purpose Test to be satisfied by an interest that is purely commercial. This decision is also consistent with Recital 47 of the GDPR which states “The processing of personal data for direct marketing purposes may (emphasis added) be regarded as carried out for a legitimate interest.”

However, it is important to highlight that all the other elements required for this lawful basis must also be satisfied. Therefore, the Necessity Test and the Balancing Test need to be fulfilled and, if either of them fail under their respective assessments, then the processing should not proceed in reliance on legitimate interests unless suitable adjustments are made to ensure the processing is lawful.  For example, in an email marketing campaign, an organisation may wish to send emails out on a daily basis to promote their products and services as much as possible, but such activity would likely fail the Necessity Test on the basis that the emails would be sent too often and that this is too intrusive. However, if the organisation reduced the frequency of the emails to once a month, this adjustment would help ensure that the Necessity Test could be satisfied.

What is not covered

It is interesting to note that the draft guidance does not mention how legitimate interests can be relied upon in relation to the use of artificial intelligence (“AI”). However, the EDPB has indicated that it proposes to issue guidance next year on the interplay between the EU data protection law and other EU laws, including separate guidance for, amongst others, the Artificial Intelligence Act, as well as guidance on the use of generative AI for data scraping. As such, this future guidance may address how legitimate interests can be applied when using AI.

What happens now

The consultation has now closed and we will await the final version to be issued in due course. Whether any amendments will be made to the draft remains to be seen but, whether or not the EDPB makes any changes, the updated guidance will be welcomed by controllers and their advisers.

For assistance on the application of the lawful basis of legitimate interests or any other data protection matter, please get in touch.