Legitimate interest / balancing of interests

Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them.

The three-step test

Art. 6(1)(f) GDPR requires a three-step test:

• There must be a legitimate interest of the controller or a third party. Legal, economic and non-material interests may qualify.
• The processing must be necessary for the purposes of that interest. If a less intrusive means is available, the processing is not permitted.
• The interests, fundamental rights and freedoms of the data subject must not override it (balancing of interests).

What matters in the balancing test

Factors to consider include in particular the reasonable expectations of the data subject, the type of data, the scale of the processing and possible safeguards. The GDPR cites fraud prevention, network and information security and direct marketing as examples of possible legitimate interests.

The balancing test should be documented. Data subjects can object to the processing under Art. 21 GDPR. Public authorities cannot rely on this legal basis in the performance of their tasks.

Legal provisions

Art. 6(1)(f) GDPR

Legitimate interest as a legal basis.

Recitals 47 to 49 GDPR

Examples of legitimate interests and guidance on the balancing test.

Art. 13(1)(d) GDPR

Obligation to state the legitimate interest pursued.

Art. 21 GDPR

Right to object to processing on this basis.