# Standards and Regulatory References ## Primary Legislation ### GDPR Article 6(1)(f) — Legitimate Interests Processing is lawful when it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Note: Art. 6(1) final paragraph states this basis shall not apply to processing carried out by public authorities in the performance of their tasks. ### GDPR Article 21 — Right to Object - **Art. 21(1)**: Data subjects have the right to object at any time to processing based on Art. 6(1)(f). The controller must cease processing unless it demonstrates compelling legitimate grounds that override the data subject's interests. - **Art. 21(2)**: Where processing is for direct marketing purposes, the data subject has an absolute right to object. - **Art. 21(3)**: When the data subject objects to direct marketing processing, processing must cease without exception. - **Art. 21(4)**: The right to object must be explicitly brought to the attention of the data subject at the time of first communication, presented clearly and separately from other information. ### GDPR Recitals - **Recital 47**: The existence of a legitimate interest needs careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place. The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing. The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest. - **Recital 48**: Controllers that are part of a group of undertakings may have a legitimate interest in transmitting personal data within the group for internal administrative purposes, including processing of clients' or employees' personal data. - **Recital 49**: Processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring network and information security constitutes a legitimate interest. ## Regulatory Guidance ### WP29 Opinion 06/2014 on the Notion of Legitimate Interests (Art. 7(f) of Directive 95/46/EC) Adopted 9 April 2014 by the Article 29 Working Party (endorsed by the EDPB). This remains the most comprehensive guidance on the legitimate interest test: - Establishes the three-part test structure: purpose, necessity, balancing. - Provides extensive analysis of factors relevant to the balancing test. - Clarifies that legitimate interests can include commercial interests, individual interests, and broader societal interests. - Lists examples: conventional direct marketing, fraud prevention, physical security, IT security, exercising the right to freedom of expression, research purposes. - Emphasises that safeguards can be decisive in the balancing test. ### EDPB Guidelines 8/2020 on the Targeting of Social Media Users Adopted 13 April 2021. Section 4.2 analyses legitimate interest in the context of social media targeting and profiling: - Profiling and targeting based on observed behaviour may qualify as legitimate interest but requires a thorough balancing test. - The intrusiveness of tracking and profiling technologies weighs against the controller. - Transparency and genuine opt-out mechanisms are essential safeguards. ### ICO Legitimate Interests Assessment Guidance (UK) The Information Commissioner's Office provides detailed practical guidance on conducting LIAs: - LIA should be documented before processing begins. - The assessment should be proportionate to the significance of the processing. - Where the balance is marginal, consider offering an opt-out. - The ICO may request the LIA as part of an investigation. ### CNIL (France) Guidance on Legitimate Interest CNIL published detailed guidance in 2023 emphasising: - The interest must be determined and not vague. - Necessity requires demonstrating that no less privacy-intrusive means is available. - The balancing test must take into account the nature of the data, data subjects' vulnerability, and the scale of processing. ## Enforcement Precedents - **Fashion ID GmbH & Co. KG v Verbraucherzentrale NRW (CJEU C-40/17, 29 July 2019)**: Joint controllers must each conduct their own legitimate interest assessment for their respective processing. The CJEU confirmed that the legitimate interest test must be applied at the point of data collection. - **Austrian DPA (DSB) — Decision D155.182 (2019)**: LIA found inadequate because the controller failed to document specific safeguards to mitigate impact on data subjects. Superficial balancing without documented analysis is insufficient. - **Dutch DPA (AP) — Fine against TikTok (2021, EUR 750,000)**: Found that the legitimate interest relied upon for processing children's data was overridden by children's fundamental rights, confirming that Art. 6(1)(f) provides heightened protection for minors. - **Norwegian DPA (Datatilsynet) — Fine against Grindr (2021, NOK 65 million / EUR 6.3 million)**: Found that sharing sensitive data with advertising partners could not be justified under legitimate interest; consent was required. ## ISO/IEC Standards - **ISO/IEC 27701:2019** — Section 7.2.2: Requires organisations to identify and document the legal basis for processing, including legitimate interest assessments where applicable. - **ISO/IEC 29134:2017** — Privacy Impact Assessment methodology: Includes proportionality and necessity assessment that aligns with the LIA necessity test.