New EDPB guidelines on legitimate interest open for comment

The European Data Protection Board (EDPB) adopted Guidelines yesterday on the processing of personal data based on legitimate interest. There is currently a public consultation on the guidelines with a closing date of 20 November 2024.

The Guidelines analyse the criteria in Art. 6(1)(f) GDPR(1) that controllers must meet to lawfully process personal data on the basis of legitimate interests. They also take into consideration the recent Court of Justice of the European Union (CJEU) ruling on the Dutch DPA’s controversial Royal Tennis Association decision, where the CJEU confirmed that legitimate interests can cover purely commercial interests.(2)

The EDPB says that Article 6(1)(f) should not be considered as an “open door” to legitimise all data processing activities which do not fall under any of the other legal bases in Article 6(1) GDPR. Rather, it should be recalled that Article 6(1)(f), like each of the legal bases set out in Article 6(1) GDPR, must be interpreted restrictively.

First of all, only the interests that are lawful, clearly and precisely articulated, real and present may be considered legitimate. For example, such legitimate interests could exist in a situation where the individual is a client or in the service of the controller, the EDPB says in a press release.

The DPAs also stress that the necessity of the processing should be evaluated against the data minimisation principle, and that legitimate interests do not override the individual’s interests, fundamental rights of freedoms. The Guidelines include useful examples of how to conduct this balancing exercise in different contexts.

Germany's newly appointed Federal Commissioner for Data Protection and Freedom of Information (BfDI), Prof. Dr. Louisa Specht-Riemenschneider, welcomed the guidelines and stressed the importance of them. She said it is hoped that the guidelines will bring more legal certainty for citizens, but also for companies.

The Guidelines make it clear that data processing based on legitimate interest should not only be viewed as a "last resort" for processing projects where other legal bases do not apply. Likewise, the legal basis should not be overly extended because it would supposedly be less restrictive than other legal bases, BfDI says.

The Guidelines were issued on 9 October.