# Regulatory Standards — Assessing Legitimate Interest vs Consent

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 6(1)(a)**: Consent — "the data subject has given consent to the processing of his or her personal data for one or more specific purposes."
- **Article 6(1)(f)**: Legitimate interest — "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
- **Article 7(4)**: "When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."
- **Recital 43**: "Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."
- **Recital 47**: "The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding... The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest."
- **Recital 48**: "Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a legitimate interest in transmitting personal data within the group of undertakings for internal administrative purposes."
- **Recital 49**: "The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security... constitutes a legitimate interest."

### ePrivacy Directive 2002/58/EC

- **Article 5(3)**: Consent required for non-essential cookies. This is a lex specialis that overrides the GDPR's legitimate interest basis for cookie-related processing.
- **Article 13(1)**: Prior consent required for unsolicited electronic communications for direct marketing.
- **Article 13(2)**: Soft opt-in exception for existing customer relationships (direct marketing for similar products).

## Case Law

### CJEU C-13/16 — Rigas (Latvian Case, 2017)

Established that legitimate interest requires a genuine balancing test. The court held that the controller's interest in fraud prevention could override privacy rights when appropriate safeguards were in place.

### CJEU C-40/17 — Fashion ID (2019)

A website embedding a Facebook "Like" button was held to be a joint controller with Facebook for the data collection phase. The court clarified that legitimate interest must be assessed for each controller in a joint controllership arrangement.

### CJEU C-252/21 — Meta Platforms (2023)

The court ruled that Meta could not rely on legitimate interest for personalized advertising. Key holding: the reasonable expectations of the data subject must be genuinely considered, and the availability of less intrusive alternatives weighs against LI.

## Supervisory Authority Guidance

### Article 29 Working Party Opinion 06/2014 on Legitimate Interest (WP217)

The definitive guidance on applying the legitimate interest balancing test:
- Three-part test: (1) identify the legitimate interest, (2) necessity of processing, (3) balancing against data subject rights
- Non-exhaustive list of legitimate interests: fraud prevention, network security, direct marketing, intra-group transfers, enforcement of legal claims
- Safeguards that strengthen LI: data minimization, pseudonymization, transparency, easy opt-out

### WP29 Opinion 2/2017 on Data Processing at Work

Confirms that employee consent is generally not valid due to power imbalance. Employers should rely on legitimate interest, legal obligation, or contract performance for employee data processing.

### ICO Legitimate Interests Assessment Template (UK)

The UK ICO provides a three-part LIA template that is widely used as a model across the EU:
1. Purpose test: Identify the legitimate interest
2. Necessity test: Consider whether the processing is necessary
3. Balancing test: Consider the individual's interests