Legitimate Interest as a Legal Basis for Data Processing

Legal Bases for Lawful Data Processing

1. Consent of the Data Subject: The individual has consented to the processing of their personal data. Consent is granted either by physically signing a document specifying the purposes and methods of data processing or by checking a box online (e.g., subscribing to a seller’s newsletter, making an online purchase, etc.).
2. Contractual Necessity: Processing is necessary for the execution of a contract with the data subject or for actions prior to entering into a contract. For example, delivering purchased goods requires the seller to collect the buyer’s delivery address and phone number, which are often shared with delivery services.
3. Legal Obligation: Processing is necessary for compliance with a legal obligation of the controller. For instance, an employer collects employee data not only to conclude an employment contract but also to fulfil mandatory insurance and tax obligations.
4. Vital Interests: Processing is necessary to protect the vital interests of the data subject or another person. For example, employers may process data of an employee’s dependents for health insurance registration.
5. Public Interest or Legal Authority: Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. For instance, the Statistical Office processes population data for census purposes.
6. Legitimate Interest: Processing is necessary for the legitimate interests of the controller or a third party unless overridden by the interests, rights, or freedoms of the data subject, especially in the case of children.

Legal Basis

1. Necessity: The processing must be necessary for the controller or third party.
2. Defined Interest: The controller must clearly define their interest.
3. Non-Infringement: The processing must not harm the interests, rights, or freedoms of the data subject, especially if the subject is a minor.

The Balancing Test

• Could the same outcome be achieved without data processing or with less processing?
• Would the data subject reasonably expect such processing, or would it be considered unacceptable?
• If the processing conflicts with the subject’s rights or causes harm, it is unlawful.

Examples

• Video Surveillance: Store owners may install cameras for security purposes, balancing this need with customers’ privacy.
• Personalized Marketing: Online stores analyze purchase data to tailor marketing campaigns. However, they must allow users to opt-out and ensure compliance with data protection laws.
• Public Transparency: A public enterprise may publish salaries of executives to foster credibility, despite the potential privacy concerns.

Misapplication

Legal Act

• The legitimate interest and its necessity.
• The impact of data processing on the data subject.
• Justification that the controller’s interest outweighs the subject’s privacy rights.

Notification and Objection

Conclusion