Legitimate interests are one of the most widely misunderstood concepts in data protection. Many businesses rely on them to process users' data, but often they do it unlawfully and violate the GDPR or another applicable data privacy law.
One of the most commonly misunderstood topics in data protection is legitimate interests. Many businesses rely on them to process user data, but they frequently do so illegally, in violation of the GDPR or another applicable data privacy law.
You've probably heard other business owners mention how they leverage legitimate interests for marketing, website analytics, or other purposes. Many of them even avoid utilizing cookie banners because they believe they can rely on legitimate interests to use cookies anyway. However, this is simply not true. Legitimate interests can be a tricky issue for online businesses. They can fit anywhere, but it is advisable not to rely on them. Business owners often believe that any business interest is permissible for user tracking, but this is not the case. There are very few genuine business interests that could allow you to track visitors without their consent. This article will guide you how to track your website visitors based on your legitimate interests the correct and safe way.
Explore more privacy compliance insights and best practices
Here you can read about:
Legitimate interest is one of the legal bases for data processing under the GDPR and other data protection laws. You can rely on them when your legitimate business interests outweigh your users', i.e., data subjects', rights and freedoms, while keeping in mind the users' reasonable expectations.
It means that you can process users' personal data when:
The tricky part is how to make sure that you rely on legitimate interests without violating the law.
You cannot rely on legitimate interests by default. They are only used as a last option. When other basis, such as contract execution or consent, are unavailable, you should only consider relying on legitimate interests.
You need to conduct a Legitimate Interests Assessment (LIA). The LIA is made of the purpose, necessity, and balancing tests. They will demonstrate whether or whether you have legitimate interests in the processing of personal data.
The purpose test determines what your purpose is in processing your users’ personal data.
The necessity test aims to determine whether personal data processing is necessary.
The balancing test determines whether your interests are vital enough to rely on them. This is a simple comparison between your and your users' interests. When your interests override theirs, you are good to go with the processing. When your interests do not outweigh the rights and freedoms of other users, you cannot rely on legitimate interests and must establish another legal basis for processing.
You conduct the purpose test by simply identifying the purpose for personal data processing. You need to know why you process the data. The purpose test does not differ in any way from determining any other processing purpose.
Once you have determined the purposes of your processing, you can proceed to the necessity test.
The necessity test is straightforward. You must consider whether the processing of personal data is required for your purpose.
Ask yourself:
For example, if you want to process personal data due to website security concerns, you need to examine whether you can protect it without personal data processing. If you discover that protection is feasible and commercially viable, i.e., the charges will not bankrupt your business, you should evaluate such technology and refrain from processing personal data.
If you find that the existing technology is insufficient or too expensive for your business, your necessity test has found that personal data processing is required for your purposes.
You can proceed to the balancing test.
The balancing test compares your interests to the interests of your users. You can only process users' personal data if you can demonstrate that your interests outweigh theirs.
In the case of the processing due to website security, you must demonstrate that your business interest in having a secure website is more important than your users' privacy rights.
Assume you process IP addresses to guarantee that your users are safe and that no user poses a threat to the website. In that instance, you must decide if users' online privacy trumps the need for a safe website.
The balancing test is not a one-size-fits-all procedure. Nobody can tell you whether your interests are more important than the interests of other users. It is up to you to make your decision.
The UK's Information Commissioner's Office (ICO) provides an excellent foundation for you to consider. According to them, legitimate interests may be appropriate when:
Legitimate interest may apply for processing for any reason and in any field. However, practice indicates that they are more prevalent in some areas than others.
However, if you process personal data for the purposes of fraud prevention, network and information security, or crime prevention, you are extremely likely to meet the standards.
You are also likely to meet the standards if you depend on legitimate interests in direct marketing activities, data processing of staff and clients, and intra-group data transfers.
Personal data can be processed based on legitimate interests in specific instances. But not in every case. You must still complete the three-part test to evaluate whether you can achieve your objectives through alternative ways.
Many businesses are mistaken when they believe that every direct marketing attempt is covered by the legitimate interest justification for processing. Recital 47 of the GDPR expressly specifies that direct marketing may come within this category, but this does not guarantee that it will.
Again, before relying on legitimate interests, you must use the three-part test.
Here are two examples that illustrate how to do this:
When conducting the balance test for marketing purposes, evaluate whether people would anticipate you to contact them in that manner, whether the marketing efforts could be seen as nuisance communications from the other side, and how frequently you receive them.
It may be okay to contact prospects infrequently to offer benefits. You still can't do it on a regular basis, even if they gave you their phone number or email address.
As with the case of direct marketing, you need to do the three-part test. However, there are many situations where it is likely that you can rely on legitimate interests for processing employee personal data.
In the case of employee personal data, it is wise to rely on the execution of a contract as a legal basis for processing. You have a contract with your employee, and to execute it, for example, to give them a salary, you need to process their data.
The data transfers between companies from the same group (same holding company) may share data with each other. In some situations, the sharing may occur based on legitimate interests.
For example, if a subsidiary firm lacks an HR department, the data is sent to the main company, where employment decisions are made. The processing will be carried out in accordance with legitimate interests.
The golden rule of legitimate interests processing is to employ it only as a last option. If you can rely on another legal basis, such as contract execution or permission, you will be on the right side of the law.
If you believe you must do it, make sure you follow the three-part criteria and confirm that there is some advantage to the data subject, or that their rights and freedoms do not outweigh yours.
Secure Privacy solution gives you control over the tracking. If you need to wait until the user opts in, it won’t let cookies out before obtaining valid consent.
Schedule a call to learn more
