Legitimate Interest

Legal Framework

The primary legal basis for legitimate interests processing is Article 6(1)(f) GDPR, which permits processing when it is "necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child." This provision creates a three-part balancing test: a legitimate interest must exist, the processing must be necessary for that interest, and the data subject's rights must not override it. Crucially, Article 6(1)(f) does not apply to processing by public authorities in the performance of their tasks.

Transparency obligations attach directly to this basis. Under Article 13(1)(d), where data is collected from the subject, the controller must inform them of "the legitimate interests pursued by the controller or by a third party." Where data is not obtained from the subject, Article 14(2)(b) imposes the same disclosure requirement.

Key Developments

The CJEU has established that the legitimate interests basis imposes three cumulative conditions. In Valsts policijas Rīgas reģiona pārvaldes Kārtības policijas pārvalde v. Rīgas pašvaldības SIA 'Rīgas satiksme', the Court held:

"Article 7(f) of Directive 95/46 lays down three cumulative conditions so that the processing of personal data is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by the third party or parties to whom the data are disclosed; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the fundamental rights and freedoms of the person concerned by the data protection do not take precedence."
— CJEU, Rīgas satiksme ¶28

The Court also clarified that this provision creates a possibility, not an obligation — controllers have discretion whether to rely on it, but must satisfy all three limbs. In RYNES, the CJEU recognised that legitimate interests can include tangible, concrete concerns such as "the protection of the property, health and life of his family and himself," confirming that the concept extends beyond purely commercial interests.

Enforcement actions reinforce the necessity limb. The Italian Garante fined the Calabrian Regional Agency €50,000 over remote-work monitoring, illustrating that vague security justifications fail when less intrusive alternatives exist. The AEPD's intervention against the University of Navarra on vaccination-status collection further shows that legitimate interests cannot override data subject autonomy where consent is the more appropriate basis.

Status of the Debate

This topic is actively contested in court. The three-part test from Rīgas satiksme provides the structural framework, but courts and DPAs diverge on how to calibrate the balancing limb — particularly the weight assigned to data subject rights relative to controller interests in employment, surveillance, and commercial profiling contexts. The EDPB's consent guidance signals that power imbalances (employment, public authority contexts) make legitimate interests harder to sustain, yet the precise boundary between legitimate-interests processing and required consent remains unsettled. What would resolve the open question is CJEU guidance on the proportionality assessment within the third limb — specifically, whether a categorical rule should exclude certain processing types (e.g., employee monitoring) from the legitimate interests basis, or whether the case-by-case approach should prevail.

Practical Guidance

• Document a three-part assessment before processing begins: Identify the specific legitimate interest, demonstrate necessity (no less intrusive alternative), and record the balancing analysis weighing data subject rights against that interest.
• Be specific in transparency notices: Under Article 13(1)(d) and Article 14(2)(b), articulate the actual interest pursued — not a generic "business operations" statement — so data subjects can understand and, where applicable, object.
• Avoid legitimate interests where power imbalances exist: In employment and public-authority contexts, the EDPB's consent guidance and enforcement trends indicate that the balancing test will frequently fail; prefer consent, contract, or legal obligation bases.
• Consider data subject expectations and vulnerability: The express reference to children in Article 6(1)(f) signals that the balancing test must account for the data subject's position; processing involving minors or sensitive contexts carries a higher override risk.
• Re-assess periodically: The balancing test is not static — changes in processing scope, new case law, or shifts in data subject expectations can tip the balance, requiring renewed justification.