When organizations think about how to collect, use, and disclose personal data in compliance with privacy laws, the first thing that usually comes to mind is that consent must be obtained. The consent requirement comes with its own complexities under the privacy laws of recent years. Yet, while there are alternatives to consent as the legal basis for the collection, use, and disclosure of personal data, these exceptions, in particular the legitimate interest exception, can be difficult to understand in all its intricacies.
This article aims to bring clarity to the legitimate interest exception as it is provided for under the GDPR and the proposed Consumer Privacy Protection Act (CPPA) of Canada.
Definitions of Legitimate Interest
Both the GDPR and the CPPA allow the processing, or the collection and use, respectively, of personal information without the individual’s consent in the absence of certain countervailing effects on the individual, so long as the organization does so for a purpose in which it has a legitimate interest.
In addition, the CPPA imposes a reasonable expectation requirement and disallows the reliance on the legitimate interest exception when the personal information is collected or used for the purpose of influencing the individual’s behaviour or decisions. Furthermore, the CPPA prescribes an adverse impact assessment and mitigation as well as corresponding record-keeping.
Recital 47 similarly requires that the individual’s reasonable expectation form part of the assessment of whether there are any overriding interests that must be considered.
View the exact definitions and requirements
| GDPR – Art. 6(f); Recital 47 | CPPA – s.18(3)-(5) | |
|---|---|---|
|
Legitimate interest language |
Data processing is lawful if and to the extent that “processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party” |
“An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest” |
|
Exception |
“except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child” “taking into consideration the reasonable expectations of data subjects based on their relationship with the controller” |
[Except where] the legitimate interest outweighs any potential adverse effect on the individual resulting from that collection or use and (a) a reasonable person would expect the collection or use for such an activity; and (b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions. “taking into consideration the reasonable expectations of data subjects based on their relationship with the controller” |
|
Conditions |
“At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.” |
(4) Prior to collecting or using personal information under subsection (3), the organization must (a) identify any potential adverse effect on the individual that is likely to result from the collection or use; (b) identify and take reasonable measures to reduce the likelihood that the effects will occur or to mitigate or eliminate them; and (c) comply with any prescribed requirements. |
|
Record of assessment |
|
(5) The organization must record its assessment of how it meets the conditions set out in subsection (4) and must, on request, provide a copy of the assessment to the Commissioner. |
Examples of legitimate interests
Examples of legitimate interests explicitly mentioned in the GDPR are processing of personal data for fraud prevention and network and information security (Recitals 47 and 49). Further examples that may constitute a legitimate interest are direct marketing purposes and the transmission of personal data within groups of undertakings or institutions for internal administrative purposes (Recital 48).
The GDPR further states that a legitimate interest could exist where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller.
This means that processing for security purposes, such as internal access controls to secure areas are a legitimate reason, as well as stopping a denial of service attack. Furthermore, maintaining employee records for internal administrative purposes and compliance with legal requirements will likely constitute a legitimate interest, provided all the requirements are met. In fact, several data protection authorities have opined that it is the only legal basis for the processing of employee data because consent will regularly not be freely given as a result of the power imbalance.
The CPPA does not provide any examples of legitimate interests. In fact, the examples the GDPR provides for legitimate interest exceptions are captured elsewhere in the CPPA, namely the sections immediately preceding the legitimate interest exception. Section 18(2), which allows for the collection and use of personal information without knowledge and consent, lists the following permitted activities:
- – an activity that is necessary to provide or deliver a product or service that the individual has requested from the organization;
- – an activity that is necessary for the organization’s information, system or network security; and
- – an activity that is necessary for the safety of a product or service that the organization provides.
It is clear that these permitted activities closely resemble some of the examples the GDPR provides in the context of the legitimate interest exception. But in contrast to the CPPA’s legitimate interest provision, in order to rely on section 18(2)’s consent exception, the organization is merely required to determine whether a reasonable person would expect such a collection or use. No adverse impact assessment and mitigation or record keeping requirements exist. But both section 18(2) and the CPPA’s legitimate interest exception clarify that they cannot be relied upon if the personal information is collected or used for the purpose of influencing the individual’s behaviour or decisions. This seems to indicate that marketing activities cannot be exempted from consent under section 18(2) or the legitimate interest exception, whereas the GDPR explicitly contemplates this possibility.
We thus seem compelled to conclude that what the GDPR captures under the legitimate interest exception is not what the CPPA means by it, because it captures GDPR-like activities under the less strict section 18(2) already. The picture that emerges, then, is that similar activities are permitted under the GDPR and the CPPA, but that the CPPA is imposing less stringent requirements on organizations pursuing a use of personal information for safety and security purposes as well as in certain instances where an existing business relationship is concerned.
What does that leave for the CPPA’s legitimate interest exception? One of the examples the GDPR provides that is not mentioned in section 18(2), but which may still be permitted under the stricter legitimate interest exception is the transmission of personal data within groups of undertakings or institutions for internal administrative purposes. Aside from that, time will tell what other use cases may fall under the CPPA’s legitimate interest exception.
Advantages and disadvantages of relying on legitimate interest
The use of legitimate interest as a basis for processing personal data under the GDPR has its advantages and disadvantages. One advantage of this approach promotes a risk-based approach to processing personal data. This means that companies are encouraged to evaluate the potential risks and benefits of processing personal data and determine whether the risks are proportional to the pursued interest, and take appropriate safeguards as a result of this assessment.
However, from a business perspective, this could also be seen as a disadvantage as data controllers are required to carry out an increased justification effort. This means that they must thoroughly analyze their data processing purposes and practices and justify why the legitimate interest overrides the fundamental rights and freedoms of data subjects. The GDPR sets a high bar for what constitutes a legitimate interest and requires that data controllers conduct a balancing test to weigh the interests of the controller against the interests of the data subject. This process can be time-consuming and may require legal expertise, which can be costly for organizations.
Another advantage of relying on legitimate interest is that it can help to avoid consent fatigue, which occurs when data subjects are repeatedly asked for their consent to process their personal data. Obtaining valid consent can be challenging for data controllers, and the use of legitimate interest as a basis for processing can alleviate the burden of obtaining consent for every processing activity. This approach can also reduce the risk of consent being withheld or withdrawn, as data subjects may become fatigued with repeated requests for consent.
Conclusion
Reliance on legitimate interest rather than consent is advisable in instances where it straightforwardly applies, either because the law specifically says that a legitimate interest exists, or where the risk assessment clearly shows that no overriding individual interest or right conflicts with the business’s interest. In cases where the assessment is not clear-cut, relying on the legitimate interest exception comes with a risk and considerable effort, which may make reliance on consent the preferable option.
