Legitimate interest: Assessments, cases, and guidelines

Legitimate interests (LI) has been a major area of contention amongst data protection experts and authorities. For instance, recently the Court of Justice of the European Union (CJEU) decided that a purely commercial interest of an organisation may be classified as a legitimate interest. In another decision the Data Protection Commission (DPC) in Ireland issued a fine to LinkedIn in its recent enforcement action, for failing to satisfy the Legitimate Interests test within the GDPR.   

The Royal Dutch Tennis Association (RDTA) decision by the Dutch Data Protection Authority (AP) resulted in the European Data Protection Board’s (EDPB) publication of Guidelines 1/2024 (Guidelines) in October 2024. These Guidelines were then applied in practice by the DPC while assessing whether LinkedIn’s reliance on LI was appropriate to process users personal data for conducting behavioural analysis. These Guidelines and decisions will be considered in this newsletter article, with the aim of providing readers with the clarity on the use of legitimate interests as a lawful basis to process personal data under GDPR Article 6(1)(f).   

 When can organisations rely on LI? 

 Organisations may rely on LI as a lawful basis only when the following three conditions coexist:  

1. The pursuit of  legitimate interests by an organisation or a third party; 
2. The processing of personal data must be necessary to achieve the legitimate interests identified by the organisation; and 
3. The legitimate interests should not take precedence over the interests, fundamental rights and freedoms of data subjects.  

It must also be clarified that in accordance with Article 6(1)(f), public authorities must not rely on LI as a lawful basis in performing their public tasks.  

What is a Legitimate Interests Assessment? 

An LIA is similar in nature, yet distinct in purpose from a Data Protection Impact Assessment (DPIA) and documents the justifications of an organisation in relying upon LI as a lawful basis. While a DPIA is a larger document, an LIA focuses on the applicability of LI as a lawful basis for the intended processing. An LIA, as an accountability document, demonstrates that the organisation has conducted the following three step test:  

Step 1: Ensuring that the interest pursued is legitimate: While the GDPR does not provide a test to assess this, the EDPB in its recent Guidelines provides some insights in how to address this:

• The interest should not be contrary to EU or Member State Law, i.e., it must be lawful; 
• The interest must be specific and properly described; and  
• The interest must be real and not speculative; that means: the interest must be present on the date of processing rather than it being hypothetical. 

If all the above criteria are satisfied, the interest may be deemed to be legitimate. Practical examples of interest that may be legitimate and helpful when undertaking this assessment are provided by Recitals 47 and 49 GDPR. In addition to the Recitals, the Guidelines also lists the following non-exhaustive examples of legitimate interests:  

1. Having access to information online; 
2. Ensuring the continued functioning of publicly accessible websites; 
3. Obtaining personal information of a person who damaged another’s property;  
4. Protecting the property, health and life of the co-owners of a building; 
5. Product improvement; and 
6. Assessing creditworthiness of individuals. 

Step 2: Processing of personal data must be necessary to achieve the legitimate interest identified: the test is not merely to judge what data is useful to the organisation, to achieve the interest. To the contrary, an organisation must justify that the interest identified may not be effectively or reasonably achieved through other means.   

Step 3: Balancing exercise: while in the previous step the organisation considered its own interest, in this third and last step the organisation must consider the following: 

• Data subjects interests, rights and freedoms 
• Impact on the data subjects resulting from the processing 
  • Nature of data  
  • Context of processing  
  • Future consequences  
• Reasonable expectations of data subjects; and 
• Mitigation measures. 

Application of the above guidelines - real scenarios: 

In 2019 the AP issued a fine of € 525,000 on RDTA for pursuing a purely commercial interest as a legitimate interest. Here the organisation was sharing data of its members with third parties for marketing purposes. Thus the AP found that RDTA has failed to satisfy the first step of the three step test. However, the Dutch District Court sough a decision from the CJEU. The CJEU found that, the interpretation presented by the AP of the first step to the LIA (assessing whether the interest is legitimate) was very narrow. The CJEU stated that: 

1. The broad nature of interests may be regarded as legitimate; and 
2. Legitimate interest are not required to be enshrined in law or statute, rather they must not be unlawful 

Therefore, the CJUE stated that purely commercial interest pursued by an organisation may be legitimate if they satisfy the above two elements. However, the CJUE did not comment on the specific facts of the RDTA case.  

Similarly, the DPC fined LinkedIn € 310 million for inappropriately relying of LI as a lawful basis to process personal data for analytics. The DPC considered the LIA that was conducted and found LinkedIn satisfied the first two steps, however failed to satisfy the third step (balancing test).  

The DPC found that the interests of LinkedIn as an organisation were overriding the fundamental rights and freedoms of individuals. This was mainly resulting from high likelihood of individuals being wrongly classified due to inaccurate personal data leading to them being targeted by inappropriate job advertisements. The DPC found that the likelihood of individuals being excluded or unable to see relevant job advertisements is high based on the data inferred by LinkedIn from:  

1. Inappropriate factors such as age or gender 
2. Interests derived from third parties such as Bing (search engine). 

LinkedIn presented an argument that the use of a legitimate interest as lawful basis to generate financial revenue by personalised advertisements had been deemed to be acceptable in the C-251/21 Meta Platforms and Others v Bundeskartellamt case (Meta case). However, upon considering the case the DPC found that Meta was also fined for unlawfully relying on LI as a lawful basis to conduct an activity (i.e. delivering targeted advertisements based on processing personal data to generate revenue). The CJEU in that case found that Meta, though allows individuals to use its platform for free, but to process data to generate revenue overrides the individua’s fundamental rights and freedoms and thus does not satisfy the balancing test of LIA. Therefore any reliance on the Meta case by LinkedIn is not founded in law. 

The DPC noted that while individuals may choose not to use all the services offered by LinkedIn, this may negatively impact individuals that are seeking employment opportunities who may thus feel compelled to use what LinkedIn claim to be the “world’s largest professional network” . 

It is evident that the DPC and other Supervisory Authorities across the European Union are seeking a robust consideration of the fundamental rights and freedoms of data subjects in an organisations’ LIA. It is also clear now that a wide range and nature of interests may be considered legitimate. However, the targeted advertisements by organisations to generate revenue cannot simply justify the processing of personal data on the basis of LI. 

Our Advice: 

1. We advise organisations to conduct LIAs when they intend to reply on LI as a lawful basis for their processing activities;  
2. The LIAs must be updated on a timely basis and should consider the mitigating measures proposed, by following EDPB guidelines.  
3. Ensure that all required elements of the LIA test are in scope; they should be simultaneously satisfied to ensure full compliance.  
4. LIAs should be retained as accountability documents and may be required to be conducted in addition to DPIAs. 
5. LIAs must be conducted on a case-by-case basis  
6. Consult with the organisation’s DPO when conducting and finalising an LIA. 

While conducting a LIA may seem challenging, our data protection and cyber-risk service have extensive experience in navigating complex compliance requirements and in assisting organisations in adapting to evolving regulatory landscapes. Our expertise ensures that your organisation stays ahead of regulatory changes, fostering resilience and trust in a rapidly changing digital world. If you would like to discuss our services, please contact our advisors.