Legitimate interest

What it means

Legitimate interest is one of the six legal bases for processing personal data under the GDPR. A company relies on it when it needs the data for its own legitimate aim that does not follow from a contract or the law, and asking for consent would be impractical or disproportionate.

Typical examples are protecting property with a CCTV system, collecting debts from debtors, securing the network and IT systems, or direct marketing to existing customers. In each case the company must be able to state precisely which interest it pursues.

Unlike consent to processing, the data subject signs nothing here. They do have the right to object, however, and the company must then show that its interest overrides the person’s rights and freedoms, or else stop the processing.

How it works in practice

Before processing starts, we prepare a written balancing test with the client. It describes the aim, checks whether it could be achieved by less intrusive means and weighs the impact on the people concerned. This is the first document the authority asks for during an inspection.

With cameras and employee monitoring it helps to define the scope clearly: which areas, how long recordings are kept and who can access them. A camera in an office pointed straight at a workstation usually fails the test.

We also state the legitimate interest in the privacy information the company publishes on its website or at the entrance to its premises. If the company has a data protection officer, we run the balancing test past them before launch.

What to watch out for

Legitimate interest is not a catch-all for cases where the company has no other basis. It cannot be used to get around consent for tracking cookies or for marketing to people the company has no relationship with.

Another risk is a balancing test written once and forgotten. When the purpose, the scope of data or the technology changes, it must be updated, otherwise the document no longer describes reality at an inspection and the company has nothing to defend the processing with.