<!-- wp:paragraph -->
<p>Much confusion around the concept of Legitimate Interest justifying Personal Data Processing. Worth going back to the roots.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>Article 6(1) of the GDPR</strong> sets out the conditions that must be met for the processing of personal data to be lawful. They are:</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>(a) the data subject has given <strong>consent</strong> to the processing of their personal data for one or more specific purposes;&nbsp;</em><br><em>(b) processing is necessary for the performance of a <strong>contract</strong> to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;&nbsp;</em><br><em>(c) processing is necessary for compliance with a <strong>legal obligation</strong> to which the controller is subject;&nbsp;</em><br><em>(d) processing is necessary in order to protect the <strong>vital interests</strong> of the data subject;&nbsp;</em><br><em>(e) processing is necessary for the performance of a task carried out in the <strong>public interest</strong> or in the exercise of official authority vested in the controller;&nbsp;</em><br><em>(f) processing is necessary for the purposes of the <strong>legitimate interests</strong> pursued by a controller, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. This shall not apply to processing carried out by public authorities in the performance of their tasks.</em><br>These conditions are all equally valid, regardless the order of appearance. Organisations should assess which of these grounds are most appropriate for different processing activities and then fulfil any further requirements the GDPR sets out for these conditions (GDPR Article 5).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Many organisations have been wrongly advised to opt for consent. The new regulation that entered into force on May 2018 requires a higher standard of consent. That explains the deluge of re-consent emails sent out around May last year. The other inconvenient of consent is the requirement to keep a register of all granted consents, with the risk that at anytime the data subject could withdraw its consent to processing. Imagine an individual giving consent for his image to be used in a commercial movie. at anytime, this person could revise its position and withdraw its consent, The organisation will have to pull out the movie. That should explain why consent is not always the most appropriate basis.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/when-can-we-rely-on-legitimate-interests/">The UK ICO</a> website explain : "<em>Legitimate interests is the most flexible of the six lawful bases. It is not focused on a particular purpose and therefore gives you more scope to potentially rely on it in many different circumstances.</em></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><em>It may be the most appropriate basis when:</em></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li><em>the processing is not required by law but is of a clear benefit to you or others;</em></li><li><em>there’s a limited privacy impact on the individual;</em></li><li><em>the individual should reasonably expect you to use their data in that way; and</em></li><li><em>you cannot, or do not want to, give the individual full upfront control (ie consent) or bother them with disruptive consent requests when they are unlikely to object to the processing.</em></li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>However, it must be clear that Legitimate Interest is not simply the interest of the organisation. It is framed within strict conditions. A three part assessment that needs to be carefully conducted and communicated to the data subject at the time the data is collected. The jurisprudence has based the conditions of necessity and the respect of rights and freedoms of individuals.  Legitimate Interest, when validly demonstrated, can exempt from requesting formal consent. In a way, consent can be implicite as the data controller will be processing the data the way it is expected to act.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Rowenna Fielding - a <em>"Professional Data Protection Nerd, Information Governance"</em> as she describes herself on her Linkedin profile - published a very useful reminder that hopefully will clarify some of the misinformation around Legitimate Interest.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>&nbsp;10 Legitimate Interests Lessons for Marketers :</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>1. Just because you're interested, doesn't make it legitimate.  </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>2. You can't use LI to avoid getting consent when you suspect the answer will be "No"</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p> 3. Whether LI can be applied depends on your own assessment of what you're doing, why and how - which you will be expected to justify and defend. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>4. LI is not 'unclear' or 'ambiguous'; it requires thinking to be done and a decision to be made. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>5. Publish your Legitimate Interests Assessments (LIA) if you anticipate/plan to reject objections to processing. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>6. If a law says you have to get consent for a processing activity, then forget about LI. You can't use it. Move on. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>7. LI is only a valid lawful basis for processing personal data if you're adhering to all of the principles. It's not a loophole around compliance. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>8. If your LIA is post-hoc rationalisation of something you won't consider ceasing to do even though you suspect it's a bit dodgy; then you wasted your time. Just make sure you have funds set aside to deal with complaints, regulatory action and reputation damage when you get found out. </p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>9. The ICO is not responsible for your continuing professional development 10. No-one else can do your thinking for you.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>The same way that consent is not a universal panacea, Legitimate Interest has to be balanced and where there is a contract to justify the processing of personal data it can be better suited. The UK ICO has an <a href="https://ico.org.uk/for-organisations/resources-and-support/lawful-basis-interactive-guidance-tool">online interactive tool</a> that helps select the most appropriate lawful base of processing.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Contact us at Data@DataRainbow.eu if you need further assistance.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p></p>
<!-- /wp:paragraph -->