No.
The GDPR prohibits a company from processing personal data unless one of six “lawful purposes” are present. One of those lawful purposes occurs when processing is necessary for a “legitimate interest pursued by the controller or by a third party.”1
Controllers have a number of legitimate interests for processing personal data. While some of those interests benefit third parties, the public, or society, others strictly benefit the controller.2 For example, a retailer might have a legitimate interest in monitoring the individuals in its store in order to keep its customers safe, deter criminals, or record illegal activity. While the interest may benefit the controller (e.g., lower crime, shoplifting, liability to customers that might otherwise be injured), the interest also benefits society and the consumers that frequent the store. Conversely, a retailer might have a legitimate interest in tracking the purchase patterns of its customers in order to better identify whether it has priced certain products too low. In that case, the legitimate interest serves just to benefit the retailer, without any direct ancillary benefit to consumers (who could be charged more in the future) or the public at large.
For more information and resources about the CCPA visit http://www.CCPA-info.com.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. GDPR, Article 6(1)(f).
2. See WP 217 at 24.
[View source.]
