Legitimate interests: the balancing test nobody writes down
The most flexible legal basis in the GDPR is also the most frequently misused. It permits a great deal – but only after a three-step test whose outcome has to be demonstrable.
Legitimate interests is the only legal basis that calls for an act of judgement. All the others can be ticked off – there either is a contract or there is not, there either is a statutory duty or there is not. Here, by contrast, a judgement stands at the end, and the law requires that it was reasoned out before processing began.
The three steps of the test
- Is there a legitimate interest?Commercial interests count. But it has to be named, concretely and in advance – not "improving our offering".
- Is the processing necessary for it?If a gentler route reaches the same goal, the test fails here. Aggregated statistics instead of individual tracking, for example.
- Do the interests of the person override it?What counts is reasonable expectation: what could be anticipated at the point of collection? Children and sensitive data weigh heavier.
Where the line runs
Two lists that often get mixed up in practice
The right to object comes with it
Anyone relying on legitimate interests has to make objection possible – and for direct marketing it applies with no reasons given and no balancing at all. An objection there stops the processing immediately and completely.
In the remaining cases processing may continue where compelling legitimate grounds are demonstrated. The burden of demonstrating them lies with the controller, not with the person objecting.
A balancing test written down nowhere carries the same weight before a supervisory authority as one that never took place.
The documentation need not be a dissertation. One page per processing operation is enough: the interest named, alternatives examined, expectations considered, safeguards taken, conclusion reached. What matters is that it came into being before processing started and carries a date.