{"id":9459,"date":"2025-01-13T13:55:14","date_gmt":"2025-01-13T12:55:14","guid":{"rendered":"http:\/\/explegal.local\/guidelines-legitimate-interest-gdpr\/"},"modified":"2026-07-08T14:54:43","modified_gmt":"2026-07-08T12:54:43","slug":"guidelines-legitimate-interest-gdpr","status":"publish","type":"post","link":"https:\/\/explegal.it\/en\/guidelines-legitimate-interest-gdpr\/","title":{"rendered":"New Guidelines on the use of Legitimate Interest in the GDPR: clarifications from the EDBP"},"content":{"rendered":"<p><span style=\"font-size: 12pt; color: #000000;\"><strong><br \/>1. Introduction<\/strong><\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\">Last\u00a0October 8, 2024 the <strong>European Data Protection Board<\/strong> (hereinafter referred to as &#8220;<strong>EDPB<\/strong>&#8220;) published its <a style=\"color: #000000;\" href=\"https:\/\/www.edpb.europa.eu\/our-work-tools\/documents\/public-consultations\/2024\/guidelines-12024-processing-personal-data-based_it\">Guidelines 1\/2024<\/a>, providing detailed instructions on using legitimate interest as a legal basis for processing personal data. This publication serves as <strong>an essential reference for both private and public entities<\/strong>, clarifying the fundamental requirements for a compliant application of Article 6(1)(f) of the GDPR. Among its key points, the document emphasizes the importance of the balancing test, a crucial tool to balance the legitimate interests of the data controller with the fundamental rights and freedoms of data subjects.<\/p>\n<p><strong><br \/>2. Why it is relevant?<\/strong><\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\">The importance of legitimate interest lies in its flexibility: it allows data controllers to <strong>process personal data without explicit consent from data subjects<\/strong>, provided strict conditions are met. However, this flexibility can also entail risks of abuse or misinterpretation. <a style=\"color: #000000;\" href=\"https:\/\/www.edpb.europa.eu\/our-work-tools\/documents\/public-consultations\/2024\/guidelines-12024-processing-personal-data-based_it\">Guidelines 1\/2024<\/a> offer a structured framework to mitigate such risks, ensuring a balanced and proportionate use of this legal basis.<\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\">Moreover, the EDPB highlights that Article 6(1)(f) of the GDPR should not be treated as a &#8220;last resort&#8221; for rare or unforeseen situations, nor should it be automatically chosen or excessively used based on a perception that it is less restrictive than other legal bases. This approach aims to preserve the integrity and effectiveness of the protections offered by the GDPR.<br \/><strong><\/p>\n<p>3.\u00a0Criteria<\/strong><\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\">According to the EDPB, using legitimate interest requires compliance with three conditions:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>The Interest<\/strong>: The pursued interest must be lawful, clearly defined, and current. For example, a company may invoke legitimate interest to monitor access to its IT systems to ensure corporate security. However, this basis would not be acceptable for processing that violates national or EU laws.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Necessity of Processing<\/strong>: The processing must be strictly necessary to achieve the declared interest. This implies that the controller must assess whether less invasive alternatives exist. For instance, an employer may monitor corporate emails to prevent security breaches, but only if other methods, such as staff training, prove insufficient.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Balancing of Interests<\/strong>: The controller\u2019s interest must not override the fundamental rights and freedoms of data subjects. For example, behavioral tracking technologies may be justified to improve user experience on a website, but they must respect visitors\u2019 privacy and provide opt-out options.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 12pt; color: #000000;\"><strong><\/p>\n<p>4. The balancing test: how does it work?<\/strong><\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\">The balancing test is a methodological tool that allows the controller to assess whether the processing is genuinely justified. This process must consider several factors:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Fundamental Rights of Data Subjects<\/strong>: These include data protection, privacy, and other constitutionally relevant freedoms, such as freedom of expression or association. For example, in a workplace context, employee monitoring must be limited and proportionate to avoid violations of personal dignity.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Impact of Processing<\/strong>: The controller must carefully analyze the nature and sensitivity of the data processed. A common example involves health data: processing such data may be justified for scientific research purposes but requires robust security measures to protect the individuals involved.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Expectations of Data Subjects<\/strong>: It is crucial to consider what data subjects expect. For instance, a customer providing their data to purchase a product might expect it to be used solely to complete the transaction, not for undisclosed marketing purposes.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 12pt; color: #000000;\">The EDPB underscores that the balancing test should not aim to avoid any impact on the rights and interests of data subjects but rather to prevent disproportionate impact by evaluating the relative weight of conflicting interests.<br \/><strong><\/p>\n<p>5. Sectors of application.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\">The guidelines provide specific recommendations for various sectors, highlighting the importance of case-by-case assessment:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Data of Minors<\/strong>: The best interest of the child must always prevail. For example, schools may process student data for educational purposes but should avoid uses that could expose minors to risks, such as commercial profiling.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Direct Marketing<\/strong>: Companies can rely on legitimate interest to send promotional communications to their customers, provided these are relevant and non-intrusive. For example, a regular customer might expect to receive offers related to previously purchased products.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Information Security<\/strong>: In an era of increasing cyber threats, using legitimate interest to ensure the security of corporate systems is often justified. However, transparent measures must be adopted to inform data subjects.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Fraud Prevention<\/strong>: Processing personal data to prevent, detect, and prosecute fraud can be based on legitimate interest, provided adequate measures are in place to protect the rights of the data subjects.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Scientific and Historical Research<\/strong>: Though less common, legitimate interest may be used in research contexts, provided the principles of data minimization and subject protection are rigorously observed.\u00a0<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 12pt; color: #000000;\"><strong><br \/>6. Practical Guidelines for Businesses.<\/strong><\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\">To ensure compliance, organizations must adopt a rigorous approach:<\/span><\/p>\n<ul>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Document the Balancing Test<\/strong>: Every decision related to legitimate interest must be supported by accurate documentation demonstrating how the processing meets the defined criteria. This documentation must be maintained and regularly updated.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Ensure Transparency:<\/strong> Companies must clearly inform data subjects about the purposes of processing, using detailed and accessible privacy notices. It is important to specify the pursued interests and the rights of data subjects in an understandable manner.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Respect Data Subjects\u2019 Rights<\/strong>: It is essential to enable data subjects to exercise their rights, such as data access, objection to processing, and data deletion. Companies must implement efficient procedures to manage such requests promptly.<\/span><\/li>\n<li><span style=\"font-size: 12pt; color: #000000;\"><strong>Evaluate Less Invasive Alternatives<\/strong>: Before proceeding with processing based on legitimate interest, companies must examine whether alternative methods achieve the same objectives with a lesser impact on the rights of data subjects.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-size: 12pt; color: #000000;\"><a style=\"color: #000000;\" href=\"https:\/\/www.edpb.europa.eu\/our-work-tools\/documents\/public-consultations\/2024\/guidelines-12024-processing-personal-data-based_it\"><br \/><strong>7. Conclusions<\/strong><\/p>\n<p>Guidelines 1\/2024<\/a> represent a crucial reference point for any business activity that involves processing personal data. These guidelines provide a clear and detailed framework for balancing the legitimate interests of data controllers with the protection of fundamental rights of data subjects, ensuring that the use of legitimate interest complies with GDPR principles. <\/p>\n<p>For further insight into how these guidelines can be applied to your business activities, we invite you to contact our <a href=\"en\/contact-en\/exp-rome\">firm<\/a>. Adhering to these guidelines not only <strong>ensures compliance with the GDPR<\/strong> but also <strong>strengthens customer trust and enhances your company\u2019s reputation<\/strong>.<\/span><\/p>\n<p><span style=\"font-size: 12pt; color: #000000;\"><\/p>\n<p><\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>1. Introduction Last\u00a0October 8, 2024 the European Data Protection Board (hereinafter referred to as &#8220;EDPB&#8220;) published its Guidelines 1\/2024, providing detailed instructions on using legitimate interest as a legal basis for processing personal data. This publication serves as an essential&#8230;<\/p>\n","protected":false},"author":30,"featured_media":9458,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[2651,2527,2322],"class_list":["post-9459","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-articles","tag-edpb","tag-gdpr","tag-privacy"],"acf":[],"_links":{"self":[{"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/posts\/9459","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/users\/30"}],"replies":[{"embeddable":true,"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/comments?post=9459"}],"version-history":[{"count":1,"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/posts\/9459\/revisions"}],"predecessor-version":[{"id":9927,"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/posts\/9459\/revisions\/9927"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/media\/9458"}],"wp:attachment":[{"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/media?parent=9459"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/categories?post=9459"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/explegal.it\/en\/wp-json\/wp\/v2\/tags?post=9459"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}