If legitimate interests are taken into account in the processing of children`s data, special care must be taken to protect the interests of users. Due to the broad definition of legitimate interests in the GDPR, it can be difficult to establish a precise definition. More importantly, some types of data processing constitute a legitimate interest in some contexts, but not in others. Data processing must be targeted and balanced in order to achieve the overall objective. Legitimate interests cannot be used as a legal basis for data processing if there is another, less intrusive way to achieve the same purpose. From there, you can decide whether legitimate interests are an appropriate legal decision or whether you need to find a more appropriate basis. In assessing the purpose, you must assess whether your purpose is a legitimate interest. If you ask and answer a series of questions, you can determine it. We have collected questions from various sources, but you can add or exclude questions as you see fit for the specific situation: granting an opt-out to individuals in the context of the use of legitimate interests should not be confused with the use of consent as a legal basis. Failure to unsubscribe does not constitute opt-in consent.
In the second step, you need to assess whether the specific processing based on a legitimate interest is really necessary to achieve its purpose. There could be other means of achieving the same objective, which are considered to be less interference with the rights and freedoms of the persons concerned. Therefore, you must be able to justify your decision and demonstrate that there is no other way to achieve the purpose, for example by processing less personal data. The employer then examines the balancing test. It takes into account that the processed data is not sensitive (names and contact details) and notes that the impact of storing this data is minimal in case of emergency. The employer decides that only its HR department has access to contact details and ensures that this data can only be used in the event of a real emergency. It notes that the balancing exercise furthers their legitimate interest in processing the data. Legitimate interest impact assessment is used to determine whether an organisation can process data on the basis of legitimate interest. This article explains which legal bases apply under the GDPR and how a legitimate interest assessment (LIA) is carried out. Lawfulness of processing is one of the fundamental principles of the GDPR, which sets out six legal bases on which controllers can rely to justify their data processing. In addition to consent and contract performance, legitimate interest is the most common. Many organisations rely on it, but are not aware that it is not enough to use this legal basis as a simple solution.
If you are relying on legitimate interests, you must carry out an appropriate assessment, which can be summed up in three key steps that must be documented. When performing an LIA, make sure you find arguments that support both parties in order to get real results, and if you get negative results on your assessment, try to redefine the purpose, minimize the scope, or find an alternative legal basis. Necessity test: it is necessary to obtain external legal expertise on the alleged fault and the relevant legal framework. Only personal data relevant to the allegations will be disclosed to their legal advisors, subject to solicitor-client privilege. LIA supports the lawfulness of your processing, proves that you have done your groundwork to determine that legitimate interests are an appropriate legal basis, confirms your compliance and allows you to comply with the accountability principle. A regular Amazon customer probably won`t mind receiving this type of direct marketing. But when they do, they are asked to withdraw. This is fair use of your personal data, and it is in Amazon`s legitimate interests to market in this way.
The GDPR does not provide a definitive or non-exhaustive list of what does or is not a legitimate interest, although it does indicate that this can range from fraud prevention to direct marketing (recitals 47 to 49). However, each scenario will be different and will ultimately have to be tested separately. Article 6 of the GDPR defines the six legal bases on which you can process personal data. You may have an individual`s consent to process their personal data. Or you have to do it if a court orders you to. Or the processing of your personal data could be in your legitimate interest. You need to save your LIA and the result. There is no specific requirement in the GDPR that you have to do this. In practice, however, you will likely need an audit trail of your decisions and a justification for processing based on legitimate interests.
If you rely on legitimate interests as the legal basis for processing personal data, it is important that you can demonstrate that you have done substantive work to determine that this is the correct legal basis for your purposes. This is called a legitimate interest assessment. LIA stands for Assessment of Legitimate Interests. This is a term that is not directly mentioned in the General Data Protection Regulation (GDPR), but LIA is a form of risk assessment and must be carried out if the processing of your personal data is based on a legitimate interest. If you decide that you do not need to carry out a DPIA, you should still carry out a lighter risk assessment to assess whether your processing could adversely affect the interests, rights and freedoms of individuals, even if it does not pose a high risk. In particular, you should consider whether your processing could contribute to this: this means that you need to analyse whether the fundamental rights and freedoms of individuals outweigh your legitimate interest. There are certain categories of data that the GDPR protects with additional requirements and safeguards such as sensitive personal data or data of minors. The environmental organisation WWF discloses many details about its legitimate interests in its privacy policy. This is done in clear and easily understandable language.
Here is an excerpt: Object test: The company must be able to manage the performance of its workforce and ensure that employees act appropriately. It must also ensure that any measures it takes comply with its labour law obligations. This is in the legitimate interest of the company`s business interests. It is also in the legitimate interest of employees that the company acts fairly and in accordance with the law in its relations with employees. Let`s take a look at Article 6(1)(f) GDPR, where the term “legitimate interests” appears for the first time. The processing is lawful if: Since you are required to choose the appropriate legal basis before you start processing personal data, this also applies to the implementation of the LIA; Once you believe that legitimate interest is the appropriate legal basis, you carry out the LIA and, depending on the result, you can start processing the personal data to achieve your specific purpose. Balancing test: The data relate to professional life, not private life. There is a clearly defined employer-employee relationship and workers would reasonably expect the company to handle the details of professional conduct to manage performance and seek legal advice on how to deal with potential dismissals.
While sharing data can cause significant harm to individuals if the recommendation supports dismissal, it should also help ensure that the decision is not arbitrary or unlawful. Data disclosure is also subject to professional secrecy, which provides protection against further risks or loss of control over the data. “Legitimate interests” include a wide range of interests, whether of the Company, third parties, commercial or for more general societal reasons. This means that you cannot simply process an individual`s personal data for any reason. You must have a valid reason for doing so. Answer questions carefully to check whether your processing activity may be based on legitimate interests.
