When is Legitimate Interest a Viable Alternative to Consent?

Aug 8, 2023
Share this post
Sharing to FacebookSharing to LinkedInSharing to XSharing to Email

When organizations think about how to collect, use, and disclose personal data in compliance with privacy laws, the first thing that usually comes to mind is that consent must be obtained. The consent requirement comes with its own complexities under the privacy laws of recent years. Yet, while there are alternatives to consent as the legal basis for the collection, use, and disclosure of personal data, these exceptions, in particular the legitimate interest exception, can be difficult to understand in all its intricacies.This article aims to bring clarity to the legitimate interest exception as it is provided for under the GDPR and the proposed Consumer Privacy Protection Act (CPPA) of Canada.

Definitions of Legitimate Interest

Both the GDPR and the CPPA allow the processing, or the collection and use, respectively, of personal information without the individual’s consent in the absence of certain countervailing effects on the individual, so long as the organization does so for a purpose in which it has a legitimate interest.In addition, the CPPA imposes a reasonable expectation requirement and disallows the reliance on the legitimate interest exception when the personal information is collected or used for the purpose of influencing the individual’s behaviour or decisions. Furthermore, the CPPA prescribes an adverse impact assessment and mitigation as well as corresponding record-keeping.Recital 47 similarly requires that the individual’s reasonable expectation form part of the assessment of whether there are any overriding interests that must be considered. View the exact definitions and requirements GDPR – Art. 6(f); Recital 47 CPPA – s.18(3)-(5) Legitimate interest language Data processing is lawful if and to the extent that “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party” “An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest” Exception “except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”“taking into consideration the reasonable expectations of data subjects based on their relationship with the controller” [Except where] the legitimate interest outweighs any potential adverse effect on the individual resulting from that collection or use and(a) a reasonable person would expect the collection or use for such an activity; and(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.“taking into consideration the reasonable expectations of data subjects based on their relationship with the controller” Conditions “At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.” (4) Prior to collecting or using personal information under subsection (3), the organization must(a) identify any potential adverse effect on the individual that is likely to result from the collection or use;(b) identify and take reasonable measures to reduce the likelihood that the effects will occur or to mitigate or eliminate them; and(c) comply with any prescribed requirements. Record of assessment (5) The organization must record its assessment of how it meets the conditions set out in subsection (4) and must, on request, provide a copy of the assessment to the Commissioner. GDPR – Art. 6(f); Recital 47 CPPA – s.18(3)-(5) Legitimate interest language Data processing is lawful if and to the extent that “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party” “An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest” Exception “except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child”“taking into consideration the reasonable expectations of data subjects based on their relationship with the controller” [Except where] the legitimate interest outweighs any potential adverse effect on the individual resulting from that collection or use and(a) a reasonable person would expect the collection or use for such an activity; and(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.“taking into consideration the reasonable expectations of data subjects based on their relationship with the controller” Conditions “At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.” (4) Prior to collecting or using personal information under subsection (3), the organization must(a) identify any potential adverse effect on the individual that is likely to result from the collection or use;(b) identify and take reasonable measures to reduce the likelihood that the effects will occur or to mitigate or eliminate them; and(c) comply with any prescribed requirements. Record of assessment (5) The organization must record its assessment of how it meets the conditions set out in subsection (4) and must, on request, provide a copy of the assessment to the Commissioner.

Examples of legitimate interests

Examples of legitimate interests explicitly mentioned in the GDPR are processing of personal data for fraud prevention and network and information security (Recitals 47 and 49). Further examples that may constitute a legitimate interest are direct marketing purposes and the transmission of personal data within groups of undertakings or institutions for internal administrative purposes (Recital 48).The GDPR further states that a legitimate interest could exist where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller.This means that processing for security purposes, such as internal access controls to secure areas are a legitimate reason, as well as stopping a denial of service attack. Furthermore, maintaining employee records for internal administrative purposes and compliance with legal requirements will likely constitute a legitimate interest, provided all the requirements are met. In fact, several data protection authorities have opined that it is the only legal basis for the processing of employee data because consent will regularly not be freely given as a result of the power imbalance.The CPPA does not provide any examples of legitimate interests. In fact, the examples the GDPR provides for legitimate interest exceptions are captured elsewhere in the CPPA, namely the sections immediately preceding the legitimate interest exception. Section 18(2), which allows for the collection and use of personal information without knowledge and consent, lists the following permitted activities:

  • -  an activity that is necessary to provide or deliver a product or service that the individual has requested from the organization;
  • -  an activity that is necessary for the organization’s information, system or network security; and
  • -  an activity that is necessary for the safety of a product or service that the organization provides.

It is clear that these permitted activities closely resemble some of the examples the GDPR provides in the context of the legitimate interest exception. But in contrast to the CPPA’s legitimate interest provision, in order to rely on section 18(2)’s consent exception, the organization is merely required to determine whether a reasonable person would expect such a collection or use. No adverse impact assessment and mitigation or record keeping requirements exist. But both section 18(2) and the CPPA’s legitimate interest exception clarify that they cannot be relied upon if the personal information is collected or used for the purpose of influencing the individual’s behaviour or decisions. This seems to indicate that marketing activities cannot be exempted from consent under section 18(2) or the legitimate interest exception, whereas the GDPR explicitly contemplates this possibility.We thus seem compelled to conclude that what the GDPR captures under the legitimate interest exception is not what the CPPA means by it, because it captures GDPR-like activities under the less strict section 18(2) already. The picture that emerges, then, is that similar activities are permitted under the GDPR and the CPPA, but that the CPPA is imposing less stringent requirements on organizations pursuing a use of personal information for safety and security purposes as well as in certain instances where an existing business relationship is concerned.What does that leave for the CPPA’s legitimate interest exception? One of the examples the GDPR provides that is not mentioned in section 18(2), but which may still be permitted under the stricter legitimate interest exception is the transmission of personal data within groups of undertakings or institutions for internal administrative purposes. Aside from that, time will tell what other use cases may fall under the CPPA’s legitimate interest exception.

Advantages and disadvantages of relying on legitimate interest

The use of legitimate interest as a basis for processing personal data under the GDPR has its advantages and disadvantages. One advantage of this approach promotes a risk-based approach to processing personal data. This means that companies are encouraged to evaluate the potential risks and benefits of processing personal data and determine whether the risks are proportional to the pursued interest, and take appropriate safeguards as a result of this assessment.However, from a business perspective, this could also be seen as a disadvantage as data controllers are required to carry out an increased justification effort. This means that they must thoroughly analyze their data processing purposes and practices and justify why the legitimate interest overrides the fundamental rights and freedoms of data subjects. The GDPR sets a high bar for what constitutes a legitimate interest and requires that data controllers conduct a balancing test to weigh the interests of the controller against the interests of the data subject. This process can be time-consuming and may require legal expertise, which can be costly for organizations.Another advantage of relying on legitimate interest is that it can help to avoid consent fatigue, which occurs when data subjects are repeatedly asked for their consent to process their personal data. Obtaining valid consent can be challenging for data controllers, and the use of legitimate interest as a basis for processing can alleviate the burden of obtaining consent for every processing activity. This approach can also reduce the risk of consent being withheld or withdrawn, as data subjects may become fatigued with repeated requests for consent.

Conclusion

Reliance on legitimate interest rather than consent is advisable in instances where it straightforwardly applies, either because the law specifically says that a legitimate interest exists, or where the risk assessment clearly shows that no overriding individual interest or right conflicts with the business’s interest. In cases where the assessment is not clear-cut, relying on the legitimate interest exception comes with a risk and considerable effort, which may make reliance on consent the preferable option.

Data Left Behind: AI Scribes’ Promises in Healthcare

Data Left Behind: Healthcare’s Untapped Goldmine

The Future of Health Data: How New Tech is Changing the Game

Why is linguistics essential when dealing with healthcare data?

Why Health Data Strategies Fail Before They Start

Private AI to Redefine Enterprise Data Privacy and Compliance with NVIDIA

EDPB’s Pseudonymization Guideline and the Challenge of Unstructured Data

HHS’ proposed HIPAA Amendment to Strengthen Cybersecurity in Healthcare and how Private AI can Support Compliance

Japan's Health Data Anonymization Act: Enabling Large-Scale Health Research

What the International AI Safety Report 2025 has to say about Privacy Risks from General Purpose AI

Private AI 4.0: Your Data’s Potential, Protected and Unlocked

How Private AI Facilitates GDPR Compliance for AI Models: Insights from the EDPB's Latest Opinion

Navigating the New Frontier of Data Privacy: Protecting Confidential Company Information in the Age of AI

Belgium’s Data Protection Authority on the Interplay of the EU AI Act and the GDPR

Enhancing Compliance with US Privacy Regulations for the Insurance Industry Using Private AI

Navigating Compliance with Quebec’s Act Respecting Health and Social Services Information Through Private AI’s De-identification Technology

Unlocking New Levels of Accuracy in Privacy-Preserving AI with Co-Reference Resolution

Strengthened Data Protection Enforcement on the Horizon in Japan

How Private AI Can Help to Comply with Thailand's PDPA

How Private AI Can Help Financial Institutions Comply with OSFI Guidelines

The American Privacy Rights Act – The Next Generation of Privacy Laws

How Private AI Can Help with Compliance under China’s Personal Information Protection Law (PIPL)

PII Redaction for Reviews Data: Ensuring Privacy Compliance when Using Review APIs

Independent Review Certifies Private AI’s PII Identification Model as Secure and Reliable

To Use or Not to Use AI: A Delicate Balance Between Productivity and Privacy

To Use or Not to Use AI: A Delicate Balance Between Productivity and Privacy

News from NIST: Dioptra, AI Risk Management Framework (AI RMF) Generative AI Profile, and How PII Identification and Redaction can Support Suggested Best Practices

Handling Personal Information by Financial Institutions in Japan – The Strict Requirements of the FSA Guidelines

日本における金融機関の個人情報の取り扱い - 金融庁ガイドラインの要件

Leveraging Private AI to Meet the EDPB’s AI Audit Checklist for GDPR-Compliant AI Systems

Who is Responsible for Protecting PII?

How Private AI can help the Public Sector to Comply with the Strengthening Cyber Security and Building Trust in the Public Sector Act, 2024

A Comparison of the Approaches to Generative AI in Japan and China

Updated OECD AI Principles to keep up with novel and increased risks from general purpose and generative AI

Is Consent Required for Processing Personal Data via LLMs?

The evolving landscape of data privacy legislation in healthcare in Germany

The CIO’s and CISO’s Guide for Proactive Reporting and DLP with Private AI and Elastic

The Evolving Landscape of Health Data Protection Laws in the United States

Comparing Privacy and Safety Concerns Around Llama 2, GPT4, and Gemini

How to Safely Redact PII from Segment Events using Destination Insert Functions and Private AI API

WHO’s AI Ethics and Governance Guidance for Large Multi-Modal Models operating in the Health Sector – Data Protection Considerations

How to Protect Confidential Corporate Information in the ChatGPT Era

Unlocking the Power of Retrieval Augmented Generation with Added Privacy: A Comprehensive Guide

Leveraging ChatGPT and other AI Tools for Legal Services

Leveraging ChatGPT and other AI tools for HR

Leveraging ChatGPT in the Banking Industry

Law 25 and Data Transfers Outside of Quebec

The Colorado and Connecticut Data Privacy Acts

Unlocking Compliance with the Japanese Data Privacy Act (APPI) using Private AI

Tokenization and Its Benefits for Data Protection

Private AI Launches Cloud API to Streamline Data Privacy

Processing of Special Categories of Data in Germany

End-to-end Privacy Management

Privacy Breach Reporting Requirements under Law25

Migrating Your Privacy Workflows from Amazon Comprehend to Private AI

A Comparison of the Approaches to Generative AI in the US and EU

Benefits of AI in Healthcare and Data Sources (Part 1)

Privacy Attacks against Data and AI Models (Part 3)

Risks of Noncompliance and Challenges around Privacy-Preserving Techniques (Part 2)

Enhancing Data Lake Security: A Guide to PII Scanning in S3 buckets

The Costs of a Data Breach in the Healthcare Sector and its Privacy Compliance Implications

Navigating GDPR Compliance in the Life Cycle of LLM-Based Solutions

What’s New in Version 3.8

How to Protect Your Business from Data Leaks: Lessons from Toyota and the Department of Home Affairs

New York's Acceptable Use of AI Policy: A Focus on Privacy Obligations

Safeguarding Personal Data in Sentiment Analysis: A Guide to PII Anonymization

Changes to South Korea’s Personal Information Protection Act to Take Effect on March 15, 2024

Australia’s Plan to Regulate High-Risk AI

How Private AI can help comply with the EU AI Act

Comment la Loi 25 Impacte l'Utilisation de ChatGPT et de l'IA en Général

Endgültiger Entwurf des Gesetzes über Künstliche Intelligenz – Datenschutzpflichten der KI-Modelle mit Allgemeinem Verwendungszweck

How Law25 Impacts the Use of ChatGPT and AI in General

Is Salesforce Law25 Compliant?

Creating De-Identified Embeddings

Exciting Updates in 3.7

EU AI Act Final Draft – Obligations of General-Purpose AI Systems relating to Data Privacy

FTC Privacy Enforcement Actions Against AI Companies

The CCPA, CPRA, and California's Evolving Data Protection Landscape

HIPAA Compliance – Expert Determination Aided by Private AI

Private AI Software As a Service Agreement

EU's Review of Canada's Data Protection Adequacy: Implications for Ongoing Privacy Reform

Acceptable Use Policy

ISO/IEC 42001: A New Standard for Ethical and Responsible AI Management

Reviewing OpenAI's 31st Jan 2024 Privacy and Business Terms Updates

Comparing OpenAI vs. Azure OpenAI Services

Quebec’s Draft Regulation Respecting the Anonymization of Personal Information

Version 3.6 Release: Enhanced Streaming, Auto Model Selection, and More in Our Data Privacy Platform

Brazil's LGPD: Anonymization, Pseudonymization, and Access Requests

LGPD do Brasil: Anonimização, Pseudonimização e Solicitações de Acesso à Informação

Canada’s Principles for Responsible, Trustworthy and Privacy-Protective Generative AI Technologies and How to Comply Using Private AI

Private AI Named One of The Most Innovative RegTech Companies by RegTech100

Data Integrity, Data Security, and the New NIST Cybersecurity Framework

Safeguarding Privacy with Commercial LLMs

Cybersecurity in the Public Sector: Protecting Vital Services

Privacy Impact Assessment (PIA) Requirements under Law25

Elevate Your Experience with Version 3.5

Fine-Tuning LLMs with a Focus on Privacy

GDPR in Germany: Challenges of German Data Privacy (Part 2)

Comply with US Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence using Private AI

How to Comply with EU AI Act using PrivateGPT