European Data Protection Board limits legitimate interests
Legitimate interests are neither a legal basis reserved for exceptional situations nor a convenient default basis for any processing that cannot be based on consent. The full text of the guidelines in the Judykatura database sets out a three-step assessment that must precede the commencement of processing. The guidelines address not only the identification of the controller’s interest, but also the strict necessity of processing and the genuine balancing of competing rights.
The rest of this analysis, all theses and the full text of the ruling are available with an AKTUALNOŚCI PLUS subscription.
Find out how EU supervisory authorities, administrative and civil courts and the CJEU reason their decisions — and keep your organisation aligned with current case law.