Direct answer · GDPR
Legitimate interest (Article 6(1)(f))
Legitimate interest (Article 6(1)(f)) requires three steps: (1) there is a legitimate interest of the organisation or a third party: lawful, clearly articulated and present; (2) the processing is necessary for that interest, so the purpose cannot reasonably be achieved with less or other data; (3) in a balancing test, the interests and fundamental rights of the data subjects do not override it, taking into account their reasonable expectations and measures that limit the impact. The Court of Justice held in KNLTB that a purely commercial interest can also be a legitimate interest, provided it is not contrary to the law. For the development and training of AI models, the EDPB applies the same three-step test (Opinion 28/2024).
For you to establish
- Is the organisation a public authority performing a public task? Then Article 6(1)(e) is the route.
Articles
- Art. 6(1)(f) GDPR The legal basis and the balancing test.
- Art. 6(1), second subparagraph GDPR Public authorities cannot rely on legitimate interest in the performance of their tasks.
- Art. 13(1)(d) GDPR The legitimate interest must be communicated to the data subject.
Case law
- KNLTB (CJEU, C-621/22, ECLI:EU:C:2024:858, 2024-10-04)Operative part: a commercial interest can be a legitimate interest, provided it is lawful; the processing must be strictly necessary.
Guidelines and decisions
- Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) GDPR (EDPB, v1.0, 2024-10-08)Guidelines 1/2024 on Article 6(1)(f): the three-step test.
- Opinion 28/2024 on certain data protection aspects related to the processing of personal data in the context of AI models (EDPB, 2024-12-17)Legitimate interest in the development and use of AI models.
