The goal of this article, as stipulated by its title, is to bring this complex notion to the understanding of every privacy stakeholder. The protection of personal data has been a major preoccupation of the European legislators in recent years. Apart from data protection being a fundamental Human Right, it is worth noting that almost all the other fundamental Human Rights rely on personal data. For instance, if a person’s personal data such as name, address, bank details and location falls into wrong hands as a result inappropriate data protection policies, the damages may range from financial losses to bodily harm-thus affecting the individual’s right to property, life et cetera. It is for these reasons that the General Data Protection Regulation lays down conditions under which personal data must be processed, grants a list of rights to data subjects and fixes very heavy fines that await defaulters.
Among the lawful grounds for processing personal data, is the legitimate interest pursued by the controller. This ground is mostly used by online marketing companies. Considering that the GDPR gives no clear definition of "legitimate interest", this article provides a clear understanding of such interest, the circumstances under which it may arise, as well as a balancing exercise and guiding factors that would help in understanding whether the legitimate interest pursued by the controller actually overrides the fundamental rights and freedoms of the data subject-a precondition for processing personal data under such grounds.
Table of Contents
1. INTRODUCTION
1.1. Processing Personal data
1.2. Lawfulness of the processing
1.3. Legitimate interest: not necessarily that of the controller
2. AN UNDERSTANDING OF LEGITIMATE INTEREST
2.1 The GDPR and the notion of legitimate interest
2.2 The WP29 and the notion of legitimate interest
3. WHEN SHOULD PERSONAL DATA BE PROCESSED UNDER LEGITIMATE INTEREST?
3.1 The balancing exercise
3.2 Factors determining the outcome of the balancing exercise
4. THE BALANCING TABLE
5. CONCLUSION
Research Objectives and Themes
This publication aims to provide a comprehensive, accessible explanation of the "legitimate interest" ground for processing personal data under Article 6(1)(f) of the GDPR. It addresses the complexity of this legal basis by offering clear guidance for data controllers on how to conduct the necessary balancing test to ensure compliance and respect for data subject rights.
- The scope and definition of legitimate interest under the GDPR and WP29 guidance.
- The necessity of conducting a three-step balancing exercise for lawful processing.
- Key factors influencing the outcome of balancing controllers' interests against data subjects' fundamental rights.
- A practical "Balancing Table" designed to assist stakeholders in compliance assessment.
Excerpt from the Book
3.1 The balancing exercise
Based on the ECJ case law and the perception of European supervisory authorities, the 3-step test provided below helps to determine whether the requirements of Art. 6 GDPR have been met:
-1st step: existence of a legitimate interest of the controller or a third party
-2nd step: necessity of data processing to protect these interests
-3rd step: balancing with the interests, fundamental rights and fundamental freedoms of the person concerned in a specific individual case
Chapter Summaries
1. INTRODUCTION: Provides an overview of the GDPR's regulatory environment and defines the basic requirements for the lawful processing of personal data.
2. AN UNDERSTANDING OF LEGITIMATE INTEREST: Explores the conceptual foundations of legitimate interest through the lens of GDPR provisions and Working Party 29 interpretations.
3. WHEN SHOULD PERSONAL DATA BE PROCESSED UNDER LEGITIMATE INTEREST?: Details the three-step balancing test and examines specific factors that determine whether an interest is valid and overrides the rights of data subjects.
4. THE BALANCING TABLE: Offers a structured, matrix-based tool to guide controllers in evaluating their processing activities against potential risks and data subject protections.
5. CONCLUSION: Reaffirms that legitimate interest requires adherence to broader data protection principles and warns against the consequences of inadequate transparency and failure to respect data subject rights.
Keywords
GDPR, Legitimate Interest, Data Processing, Article 6(1)(f), Data Controller, Data Subject, Balancing Exercise, WP29, Privacy Law, Fundamental Rights, Transparency, Personal Data, Compliance, Profiling, Marketing.
Frequently Asked Questions
What is the primary focus of this work?
This work focuses on explaining the concept of "legitimate interest" as a lawful basis for processing personal data under Article 6(1)(f) of the General Data Protection Regulation (GDPR).
Who is this publication intended for?
It is designed for privacy stakeholders and data controllers who need to understand how to lawfully apply the legitimate interest ground in their operations.
What is the central research question?
The core inquiry is how data controllers can correctly identify, justify, and balance their legitimate interests against the fundamental rights and freedoms of data subjects.
What methodology does the author use?
The author employs a legal analysis of GDPR provisions, combined with interpretations from the Working Party 29 (WP29) and relevant case law from the European Court of Justice (ECJ).
What does the main body cover?
The main body covers the definitions of personal data, the legal requirements for processing, the nuances of "legitimate interest," and the practical application of a 3-step balancing test.
Which keywords best describe the content?
Key terms include GDPR, Legitimate Interest, Balancing Exercise, Data Controller, Data Subject, Privacy, and Compliance.
How does the "Balancing Table" assist the reader?
The table provides a structured, question-based framework that allows practitioners to quickly assess whether their specific processing activity aligns with the requirements of Article 6(1)(f).
Why is the "necessity" test important?
Necessity is critical because a controller must establish a substantial link between the processing and their purpose; if the goal can be achieved without processing personal data, the legitimate interest ground is not fulfilled.
Does legitimate interest only apply to the controller's own interests?
No, the text explicitly notes that legitimate interests can also be those of third parties, such as the public interest in transparency or the interests of other stakeholders like employees or journalists.
What role do "vulnerable people" play in the balancing process?
The text highlights that when processing involves children or other vulnerable individuals, there is a higher weighting of the interests, fundamental rights, and freedoms of the data subjects, making it harder for the controller's interest to prevail.
- Arbeit zitieren
- Mario Egbe Mpame (Autor:in), 2019, Processing personal data under Art. 6.1.f GDPR, München, GRIN Verlag, https://www.grin.com/document/493853
