The GDPR prohibits a company from processing personal data unless one of six “lawful purposes” are present. One of those lawful purposes occurs when processing is necessary for a “legitimate interest pursued by the controller or by a third party.”1
While the GDPR does not define what constitutes a “legitimate interest,” regulatory authorities have explained that an “interest” refers to the “benefit” anticipated from a processing activity.2 The benefit must be “real and present” and be anticipated either immediately or “in the very near future.”3 As a result, benefits that are “vague or speculative” may not be viewed as sufficiently concrete to be “interests” of an organization.
Although an interest must be imminent, it does not have to be enunciated as a concrete processing act. As a result, supervisory authorities have distinguished between “interests” which relate to broadly defined benefits, and “purposes” of processing which can be more specific explanations of the “aim or intention of the data processing.”4 So, for example, a company would have an “interest” in “marketing,” whereas its “purpose” for sending out a specific communication by email might be to explain a new product or service offering to existing clients.
This article is part of a multi-part series published by BCLP to help companies understand and implement the General Data Protection Regulation, the California Consumer Privacy Act and other privacy statutes. You can find more information on the CCPA in BCLP’s California Consumer Privacy Act Practical Guide, and more information about the GDPR in the American Bar Association’s The EU GDPR: Answers to the Most Frequently Asked Questions.
1. GDPR, Article 6(1)(f).
2. WP 217 at 24.
3. WP 217 at 24.
4. WP 217 at 24.
[View source.]
