Legitimate Interests as a Legal Basis
Legitimate interests is one of the six legal bases for processing under Article 6(1)(f) of the GDPR. It is the most flexible legal basis, but requires careful assessment to ensure it is applied appropriately.
What are Legitimate Interests?
Legitimate interests can be your own interests or the interests of third parties. They can include:
- Commercial interests (e.g., direct marketing, fraud prevention)
- Individual interests (e.g., accessing online services)
- Societal interests (e.g., network and information security)
However, you cannot automatically assume that your interests are legitimate - you must assess this for each processing purpose.
The Three-Part Test
To rely on legitimate interests, you must pass a three-part test:
- Purpose test: Identify a legitimate interest - Is the purpose something that is a real and present interest, not speculative?
- Necessity test: Show that the processing is necessary to achieve it - Could you achieve the same result in a less intrusive way?
- Balancing test: Balance it against the individual's interests, rights and freedoms - Would individuals reasonably expect this processing? What is the impact on them?
Legitimate Interests Assessment (LIA)
You must document your legitimate interests assessment, considering:
- The nature of your legitimate interest
- Why processing is necessary
- Impact on individuals (nature, extent, likelihood, severity)
- Any additional safeguards to mitigate impact
- Whether individuals would reasonably expect the processing
Right to Object
When processing is based on legitimate interests, individuals have the right to object under Article 21. You must stop processing unless you can demonstrate compelling legitimate grounds that override their interests, or the processing is for legal claims.
When Not to Use Legitimate Interests
Legitimate interests cannot be used:
- By public authorities performing their tasks
- For most processing of special category data (with limited exceptions)
- When individuals would not reasonably expect the processing and it would be unfair