When is Legitimate Interest a Viable Alternative to Consent?

Share This Post

When organizations think about how to collect, use, and disclose personal data in compliance with privacy laws, the first thing that usually comes to mind is that consent must be obtained. The consent requirement comes with its own complexities under the privacy laws of recent years. Yet, while there are alternatives to consent as the legal basis for the collection, use, and disclosure of personal data, these exceptions, in particular the legitimate interest exception, can be difficult to understand in all its intricacies. 

This article aims to bring clarity to the legitimate interest exception as it is provided for under the GDPR and the proposed Consumer Privacy Protection Act (CPPA) of Canada.

Definitions of Legitimate Interest

Both the GDPR and the CPPA allow the processing, or the collection and use, respectively, of personal information without the individual’s consent in the absence of certain countervailing effects on the individual, so long as the organization does so for a purpose in which it has a legitimate interest. 

In addition, the CPPA imposes a reasonable expectation requirement and disallows the reliance on the legitimate interest exception when the personal information is collected or used for the purpose of influencing the individual’s behaviour or decisions. Furthermore, the CPPA prescribes an adverse impact assessment and mitigation as well as corresponding record-keeping.

Recital 47 similarly requires that the individual’s reasonable expectation form part of the assessment of whether there are any overriding interests that must be considered. 

View the exact definitions and requirements
GDPR – Art. 6(f); Recital 47 CPPA – s.18(3)-(5)
Legitimate interest language
Data processing is lawful if and to the extent that “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party”
“An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest”
Exception
“except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”

“taking into consideration the reasonable expectations of data subjects based on their relationship with the controller”
[Except where] the legitimate interest outweighs any potential adverse effect on the individual resulting from that collection or use and

(a) a reasonable person would expect the collection or use for such an activity; and

(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions. “taking into consideration the reasonable expectations of data subjects based on their relationship with the controller”
Conditions
“At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.”
(4) Prior to collecting or using personal information under subsection (3), the organization must

(a) identify any potential adverse effect on the individual that is likely to result from the collection or use;

(b) identify and take reasonable measures to reduce the likelihood that the effects will occur or to mitigate or eliminate them; and

(c) comply with any prescribed requirements.
Record of assessment
(5) The organization must record its assessment of how it meets the conditions set out in subsection (4) and must, on request, provide a copy of the assessment to the Commissioner.

Examples of legitimate interests

Examples of legitimate interests explicitly mentioned in the GDPR are processing of personal data for fraud prevention and network and information security (Recitals 47 and 49). Further examples that may constitute a legitimate interest are direct marketing purposes and the transmission of personal data within groups of undertakings or institutions for internal administrative purposes (Recital 48). 

The GDPR further states that a legitimate interest could exist where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller. 

This means that processing for security purposes, such as internal access controls to secure areas are a legitimate reason, as well as stopping a denial of service attack. Furthermore, maintaining employee records for internal administrative purposes and compliance with legal requirements will likely constitute a legitimate interest, provided all the requirements are met. In fact, several data protection authorities have opined that it is the only legal basis for the processing of employee data because consent will regularly not be freely given as a result of the power imbalance. 

The CPPA does not provide any examples of legitimate interests. In fact, the examples the GDPR provides for legitimate interest exceptions are captured elsewhere in the CPPA, namely the sections immediately preceding the legitimate interest exception. Section 18(2), which allows for the collection and use of personal information without knowledge and consent, lists the following permitted activities:

  • –  an activity that is necessary to provide or deliver a product or service that the individual has requested from the organization;
  • –  an activity that is necessary for the organization’s information, system or network security; and
  • –  an activity that is necessary for the safety of a product or service that the organization provides. 

It is clear that these permitted activities closely resemble some of the examples the GDPR provides in the context of the legitimate interest exception. But in contrast to the CPPA’s legitimate interest provision, in order to rely on section 18(2)’s consent exception, the organization is merely required to determine whether a reasonable person would expect such a collection or use. No adverse impact assessment and mitigation or record keeping requirements exist. But both section 18(2) and the CPPA’s legitimate interest exception clarify that they cannot be relied upon if the personal information is collected or used for the purpose of influencing the individual’s behaviour or decisions. This seems to indicate that marketing activities cannot be exempted from consent under section 18(2) or the legitimate interest exception, whereas the GDPR explicitly contemplates this possibility. 

We thus seem compelled to conclude that what the GDPR captures under the legitimate interest exception is not what the CPPA means by it, because it captures GDPR-like activities under the less strict section 18(2) already. The picture that emerges, then, is that similar activities are permitted under the GDPR and the CPPA, but that the CPPA is imposing less stringent requirements on organizations pursuing a use of personal information for safety and security purposes as well as in certain instances where an existing business relationship is concerned. 

What does that leave for the CPPA’s legitimate interest exception? One of the examples the GDPR provides that is not mentioned in section 18(2), but which may still be permitted under the stricter legitimate interest exception is the transmission of personal data within groups of undertakings or institutions for internal administrative purposes. Aside from that, time will tell what other use cases may fall under the CPPA’s legitimate interest exception. 

Advantages and disadvantages of relying on legitimate interest 

The use of legitimate interest as a basis for processing personal data under the GDPR has its advantages and disadvantages. One advantage of this approach promotes a risk-based approach to processing personal data. This means that companies are encouraged to evaluate the potential risks and benefits of processing personal data and determine whether the risks are proportional to the pursued interest, and take appropriate safeguards as a result of this assessment.

However, from a business perspective, this could also be seen as a disadvantage as data controllers are required to carry out an increased justification effort. This means that they must thoroughly analyze their data processing purposes and practices and justify why the legitimate interest overrides the fundamental rights and freedoms of data subjects. The GDPR sets a high bar for what constitutes a legitimate interest and requires that data controllers conduct a balancing test to weigh the interests of the controller against the interests of the data subject. This process can be time-consuming and may require legal expertise, which can be costly for organizations.

Another advantage of relying on legitimate interest is that it can help to avoid consent fatigue, which occurs when data subjects are repeatedly asked for their consent to process their personal data. Obtaining valid consent can be challenging for data controllers, and the use of legitimate interest as a basis for processing can alleviate the burden of obtaining consent for every processing activity. This approach can also reduce the risk of consent being withheld or withdrawn, as data subjects may become fatigued with repeated requests for consent.

Conclusion

Reliance on legitimate interest rather than consent is advisable in instances where it straightforwardly applies, either because the law specifically says that a legitimate interest exists, or where the risk assessment clearly shows that no overriding individual interest or right conflicts with the business’s interest. In cases where the assessment is not clear-cut, relying on the legitimate interest exception comes with a risk and considerable effort, which may make reliance on consent the preferable option.

Subscribe To Our Newsletter

Sign up for Private AI’s mailing list to stay up to date with more fresh content, upcoming events, company news, and more! 

More To Explore

Blog

Is Salesforce Law25 Compliant?

Although they hardly need an introduction, Salesforce is a cloud-based customer relationship management (CRM) service that allows businesses to efficiently connect with their customers, find

Read More »

Download the Free Report

Request an API Key

Fill out the form below and we’ll send you a free API key for 500 calls (approx. 50k words). No commitment, no credit card required!

Language Packs

Expand the categories below to see which languages are included within each language pack.
Note: English capabilities are automatically included within the Enterprise pricing tier. 

French
Spanish
Portuguese

Arabic
Hebrew
Persian (Farsi)
Swahili

French
German
Italian
Portuguese
Russian
Spanish
Ukrainian
Belarusian
Bulgarian
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
Greek
Hungarian
Icelandic
Latvian
Lithuanian
Luxembourgish
Polish
Romanian
Slovak
Slovenian
Swedish
Turkish

Hindi
Korean
Tagalog
Bengali
Burmese
Indonesian
Khmer
Japanese
Malay
Moldovan
Norwegian (Bokmål)
Punjabi
Tamil
Thai
Vietnamese
Mandarin (simplified)

Arabic
Belarusian
Bengali
Bulgarian
Burmese
Catalan
Croatian
Czech
Danish
Dutch
Estonian
Finnish
French
German
Greek
Hebrew
Hindi
Hungarian
Icelandic
Indonesian
Italian
Japanese
Khmer
Korean
Latvian
Lithuanian
Luxembourgish
Malay
Mandarin (simplified)
Moldovan
Norwegian (Bokmål)
Persian (Farsi)
Polish
Portuguese
Punjabi
Romanian
Russian
Slovak
Slovenian
Spanish
Swahili
Swedish
Tagalog
Tamil
Thai
Turkish
Ukrainian
Vietnamese

Rappel

Testé sur un ensemble de données composé de données conversationnelles désordonnées contenant des informations de santé sensibles. Téléchargez notre livre blanc pour plus de détails, ainsi que nos performances en termes d’exactitude et de score F1, ou contactez-nous pour obtenir une copie du code d’évaluation.

99.5%+ Accuracy

Number quoted is the number of PII words missed as a fraction of total number of words. Computed on a 268 thousand word internal test dataset, comprising data from over 50 different sources, including web scrapes, emails and ASR transcripts.

Please contact us for a copy of the code used to compute these metrics, try it yourself here, or download our whitepaper.