Legitimate interest / balancing of interests

Legitimate interests constitute a legal basis for the processing of personal data under Article 6(1)(f) GDPR. Companies may process personal data on this basis if the processing is necessary for the purposes of the legitimate interests pursued and those interests are not overridden by the interests or fundamental rights and freedoms of the data subjects. Whether these conditions are met must be assessed as part of a balancing test. Where this legal basis applies, consent is generally not required.

When does a legitimate interest exist under the GDPR?

Under Article 6(1)(f) GDPR, the processing of personal data may be lawful if it is necessary for the purposes of the legitimate interests pursued by the controller or a third party.

A legitimate interest may be economic, legal or factual in nature. The interest pursued must be lawful, sufficiently specific and genuinely present.

Examples of possible legitimate interests include:

• Protection of company property and business premises
• Prevention and investigation of attempted fraud
• Ensuring the security of IT systems
• Establishment or defence of legal claims
• Certain direct marketing activities
• Protection against unauthorised access to personal data

However, the existence of a legitimate interest does not automatically mean that the intended data processing is lawful.

The processing must also be necessary to achieve the purpose pursued. In addition, the interests or fundamental rights and freedoms of the data subjects must not override the legitimate interests.

How is a balancing test carried out?

A balancing test is used to determine whether the processing of personal data can be based on Article 6(1)(f) GDPR.

As a rule, the assessment involves three steps:

• Identifying the legitimate interest: First, the controller must determine the specific interest pursued through the data processing. General references to economic benefits or business interests are not sufficient for a meaningful assessment.
• Assessing necessity: The controller must then examine whether the processing is suitable and necessary to pursue the legitimate interest. If equally effective, less intrusive means are available, the processing in the proposed form cannot be based on Article 6(1)(f) GDPR.
• Balancing the competing interests: Finally, the controller's or a third party's interests are weighed against the interests and fundamental rights and freedoms of the data subjects.

The following circumstances may be relevant in particular:

• Nature and sensitivity of the personal data
• Scope and duration of the processing
• Possible effects on the data subjects
• The data subjects' reasonable expectations regarding the processing
• Existing relationship between the controller and the data subject
• Measures to mitigate potential adverse effects

Particular weight must be given to the protection of children's personal data.

Processing is permissible on this legal basis only if, following the assessment, the interests or fundamental rights and freedoms of the data subjects do not override the legitimate interests pursued.

What role do legitimate interests play in direct marketing?

Recital 47 GDPR clarifies that the processing of personal data for direct marketing purposes may be regarded as processing carried out for a legitimate interest.

However, this does not amount to a general authorisation for all marketing activities.

Even in the context of direct marketing, companies must assess whether the specific processing is necessary and whether the interests of the data subjects override the legitimate interest pursued.

Other statutory requirements must also be taken into account. In particular, additional requirements under the German Act Against Unfair Competition (UWG) may apply to marketing by email or telephone.

Under Article 21(2) and (3) GDPR, data subjects may object at any time to the processing of their personal data for direct marketing purposes. In that case, the personal data may no longer be processed for those purposes.

Whether a marketing activity is lawful therefore depends both on the data protection balancing test and on the other applicable statutory provisions.

What information and documentation obligations apply?

Companies must be able to demonstrate in a comprehensible manner why processing is based on Article 6(1)(f) GDPR.

The accountability principle under Article 5(2) GDPR requires controllers to be able to demonstrate compliance with the data protection principles.

Clear documentation of the balancing test is particularly important in this regard.

It should include, in particular:

• Description of the planned data processing
• Specific identification of the legitimate interest
• Justification of necessity
• Assessment of the interests and rights of data subjects
• Description of possible safeguards
• Outcome of the balancing test

In addition, where controllers rely on Article 6(1)(f) GDPR, they must inform data subjects of the legitimate interests pursued under Article 13(1)(d) or Article 14(2)(b) GDPR, as applicable.

A balancing test that has already been carried out should be reviewed again if material circumstances relating to the processing change.

What rights do data subjects have when processing is based on legitimate interests?

Even where data processing is based on a legitimate interest, the statutory rights of data subjects remain unaffected.

These include, in particular, the right of access under Article 15 GDPR and, subject to the relevant conditions, the rights to rectification, erasure and restriction of processing.

The right to object under Article 21 GDPR is of particular importance.

Under Article 21(1) GDPR, data subjects may object, on grounds relating to their particular situation, to processing based on Article 6(1)(f) GDPR.

The controller must then generally cease processing the personal data unless it can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject. Further processing may also be permissible for the establishment, exercise or defence of legal claims.

A stricter rule applies to direct marketing: following an objection under Article 21(2) GDPR, personal data may no longer be processed for marketing purposes.

Companies must therefore establish appropriate procedures to identify objections and handle them in accordance with the law.

Practical example: Video surveillance to prevent theft

A retail company has repeatedly experienced thefts in the entrance and checkout areas of its premises.

To prevent further incidents and investigate potential criminal offences, the company intends to install video cameras in these areas.

The protection of company property may constitute a legitimate interest in this context.

Before introducing video surveillance, the company must assess whether the measure is necessary to achieve this purpose and whether less intrusive measures are available.

The subsequent balancing test must take account, in particular, of the data subjects affected, the areas being monitored, the duration of the recordings and the potential impact on privacy.

Video surveillance limited to particularly vulnerable areas may be permissible subject to the statutory requirements. By contrast, comprehensive and indiscriminate surveillance of all employees and customers cannot be justified solely by reference to a general security interest.

legal data assessment: Companies should not regard processing based on legitimate interests as a blanket alternative to obtaining consent. What matters is a comprehensible assessment of the specific purpose of processing, its necessity and the competing interests of data subjects. A documented balancing test and appropriate measures to limit data processing help demonstrate compliance with the GDPR and reduce data protection risks.

Legal basis

Article 6(1)(f), Article 13(1)(d), Article 14(2)(b) and Article 21 GDPR; in addition, in particular, Recitals 47–49 GDPR and, in the context of direct marketing, the relevant provisions of the German Act Against Unfair Competition (UWG).