At its plenary session on 7 and 8 October, the European Data Protection Board (EDPB) adopted Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (legitimate interest) and has put up a public consultation on these guidelines. The deadline to provide comments is 20 November 2024.
Based on case law, the authorities set out three conditions for the use of legitimate interest as a legal basis for processing. Firstly, such an interest must exist: it must be ‘lawful, precisely formulated and up-to-date’, and it must be explained to the data subject. Above all, the controller must demonstrate that it is ‘necessary’ to process the data in order to pursue this interest, i.e. that there is no other option ‘less restrictive of fundamental rights and freedoms’ for ‘reasonably achieving’ the same aims. As the Court held on 4 October, ‘the interests or fundamental rights and freedoms of the data subjects must not take precedence over the legitimate interest of the controller’.
These guidelines, which also analyse the application of this legal basis in various contexts (including advertising), are open to consultation until 20 November.
Link to the guidelines
Link to provide comments
FEBIS is analysing these guidelines, will answer to the consultation and work on a comments' paper.
Source: EDPB
Write a comment