united-kingdom gdpr european-union data-protection reference-request
What references are available for the GDPR legitimate interests balancing test?
<p>A basis for the processing of personally identifiable data (PII) is legitimate interest.  <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/how-do-we-apply-legitimate-interests-in-practice/" rel="nofollow noreferrer">According to the UK ICO</a> data controllers who rely on this basis should conduct a legitimate interests assessment.  A part of this is the balancing test, which involves:</p>
<blockquote>
<p>You need to weigh up all the factors identified during your LIA for and against the processing, and decide whether you still think your interests should take priority over any risk to individuals. This is not a mathematical exercise and there is an element of subjectivity involved, but you should be as objective as possible.</p>
</blockquote>
<p>In many cases this balance test will involve comparing things that appear inherently incomparable.  For example many websites, including all major UK newspapers, this includes processing data for targeted advertisements.  The <a href="https://www.dailymail.co.uk/home/index.html" rel="nofollow noreferrer">Daily Mail</a> has 467 vendors that rely on legitimate interest to technically deliver ads or content, including Huawei.</p>
<p>Presumably they have performed a legitimate interests assessment that balanced a users desire to not have their browsing behaviour monitored, analysed and monentised against the desire of Huawei to monitor and analyse their browsing behaviour and the Mail Group to monetise it.  These seem inherently incomparable, but I have no doubt that <a href="https://en.wikipedia.org/wiki/Daily_Mail_and_General_Trust" rel="nofollow noreferrer">Viscount Rothermere</a> thinks his interests should take priority over any risk to the sites users.</p>
<p>What can one refer to when conducting a legitimate interests assessment?  <a href="https://www.legislation.gov.uk/eur/2016/679/article/35" rel="nofollow noreferrer">The legislation</a> does not seem to provide any objective measure that can be applied to this balancing of desires and the ICO guidance above appears to leave it to which interests the data controller thinks should take priority.  As I understand it there is no requirement for data controllers to make this assessment public so we cannot base it on what others do.  Have there been any court cases where the assessment was considered and perhaps made public?  Is there any more detailed guidance from other countries that could guide this decision?</p>

<p>The guidance on this subject is somewhat slim. Ultimately, disagreement about a legitimate interest balancing test will have to be decided by a court.</p>
<p>The GDPR allows processing activities if</p>
<blockquote>
<p>processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.</p>
</blockquote>
<p>(Art 6(1)(f) GDPR)</p>
<p>Details are given in Recital 47, which suggests that the balancing test must consider “the reasonable expectations of data subjects based on their relationship with the controller”:</p>
<blockquote>
<p><sup>1</sup>The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.
<sup>2</sup>Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller.
<sup>3</sup>At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.
<sup>4</sup>The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.
<sup>5</sup>[…].
<sup>6</sup>The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.
<sup>7</sup>The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.</p>
</blockquote>
<p>The EDPB's predecessor WP29 issued an opinion on legitimate interests in 2014 (document WP-217, <a href="https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2014/wp217_en.pdf" rel="nofollow noreferrer">PDF link</a>). While this relates to the old Data Protection Directive rather than to the GDPR, the general concepts should be transferable.</p>
<p>For the UK, the ICO has issued the guidance linked in the question. It contains an explanation of a three-part test developed from case law (purpose – necessity – balancing), provides various examples, and suggests a number of questions that can be used to start a legitimate interest balancing test. For example, to assess the reasonable expectations of the data subject, <a href="https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/how-do-we-apply-legitimate-interests-in-practice/#why_LIA" rel="nofollow noreferrer">the following prompts are given</a>:</p>
<blockquote>
<p>You need to consider whether people will reasonably expect you to use their data in this way in the particular circumstances.
You should consider all relevant factors, including:</p>
<ul>
<li>Do you have an existing relationship with the individual? If so, what is the nature of that relationship?</li>
<li>How have you used their data in the past?</li>
<li>Did you collect data directly from the individual?</li>
<li>What did you tell individuals at the time?</li>
<li>If you obtained the data from a third party, what did they tell individuals about reuse of the data by third parties for other purposes?</li>
<li>How long ago was the data collected? Are there any changes in technology or other context since that time that would affect current expectations?</li>
<li>Is your intended purpose and method obvious or widely understood?</li>
<li>Are you intending to do anything new or innovative?</li>
<li>Do you have any actual evidence about expectations, eg from market research, focus groups or other forms of consultation?</li>
<li>Are there any other factors in the particular circumstances that mean they would or would not expect the processing?</li>
</ul>
<p>This is an objective test.
You do not have to show that every individual does in fact expect you to use their data in this way.
Instead, you have to show that a reasonable person would expect the processing in light of the particular circumstances.</p>
</blockquote>
<p>The ICO guidance is, to my knowledge, the best and most up to date publicly available resource on this matter.</p>
<hr />
<p>You are right to be frustrated about the current use of legitimate interests in typical consent management frameworks for tracking or advertising purposes. There is the perverse but technically correct argument that since advertising and tracking is so common, that a data subject must reasonably expect it on typical websites. On the other hand, there is no “relevant and appropriate relationship between the data subject and the controller” where the data controllers are hundreds of third parties in the depths of the advertising, tracking, and data brokering industries.</p>
<p>My assumption is that the current state of internet advertising through the use of large advertising networks is not GDPR compliant. The legitimate interests claimed in consent management tools are often extremely spurious. To be clear, direct marketing and showing ads is probably perfectly fine, but sharing the information with an indeterminate number of third parties is probably not. While such sharing is necessary given the <em>current</em> state of advertising networks, the sharing is not <em>fundamentally</em> necessary for advertising.</p>
<p>The individual publishers are not necessarily to blame. Sure, they are data controllers and are at least jointly responsible for whatever happens on their websites. But the abuse of legitimate interests for internet advertising purposes is more of a systemic problem. I would lay a lot of the blame on the Internet Advertising Bureau (IAB) which standardizes data models and vendor lists for consent management tools. These lists are sometimes copied by publishers in a false sense of security.</p>
<p>The GDPR has no <em>explicit</em> right to demand access to internal compliance documents such as a legitimate interest analysis. Supervisory authorities are clearly authorized to access such documents during an investigations. Data subject could instead invoke the Art 5(2) accountability principle:</p>
<blockquote>
<p>The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).</p>
</blockquote>
<p>The paragraph 1 of Art 5 contains, among other principles, the lawfulness principle. Relying on a legitimate interest per Art 6(1)(f) can be lawful, so that demonstrating compliance could require disclosure of the legitimate interest analysis. This interpretation seems to be commonly shared by supervisory authorities and is occasionally implied by EDPB guidelines, but there has yet to be official guidance or a clear court judgement on this matter.</p>
