Antonio Tejeda Encinas CEO Meta Channel Corp . President of the Euro-American Digital Law Committee
1. Introduction
The processing of personal data in the business environment has undergone significant transformations with the implementation of the General Data Protection Regulation (GDPR). One of the most controversial issues is the use of “legitimate interest” as a legal basis for handling data, regulated in Article 6.1(f) of the GDPR. The recent judgment of the Court of Justice of the European Union (CJEU) in case C-621/22 has generated new discussions on the interpretation of this concept, especially in relation to commercial activities.
The purpose of this report is to explore how legitimate interest and commercial interest interact in the light of recent case law in the European Union. In addition, practical guidelines are provided for businesses, so they can ensure regulatory compliance without impacting their business objectives.
2. The Concept of Legitimate Interest in the GDPR
The GDPR includes legitimate interest as one of the legal bases for handling personal data, but does not provide a detailed definition. According to Article 6.1(f), data processing is lawful if it is carried out to meet the “legitimate interests” of the controller or a third party, provided that these do not override the fundamental rights and freedoms of the person whose data is processed.
This implies that, in order to determine whether an interest is legitimate, a contextual assessment is required, based on the principles of realism and specificity. Recitals 47, 48 and 49 of the GDPR provide guidelines, stating that the legitimate interest must be tangible, current and not merely speculative. Thus, the application of this legal basis must be carried out after careful analysis of the interests involved.
Legitimate interest may include objectives such as fraud prevention, security of network systems, or the protection of business assets. However, when seeking to justify commercial activities, such as marketing or advertising, the evaluation becomes stricter, considering factors such as predictability for those affected and the transparency of the processes.
3. Relationship between Legitimate Interest and Commercial Interest
Commercial interest, understood as the intention to obtain economic gain or a competitive advantage, may be acceptable under the GDPR if certain requirements are met. However, the Spanish Data Protection Agency (AEPD) and the Supreme Court of Spain have expressed reservations regarding the prevalence of these interests when they conflict with the fundamental rights of individuals.
In its ruling 840/2020, the Supreme Court stated that a company’s business objectives cannot prevail over the individual’s right to data protection. In contrast, the UK’s Information Commissioner’s Office (ICO) has taken a more flexible approach, allowing certain processing for commercial purposes if a rigorous proportional assessment is carried out.
The CJEU Judgment in Case C-621/22 addresses this issue, providing guidance on when a commercial interest can be considered legitimate. In that case, the interest concerned the transfer of personal data of the members of a sports federation to third parties for marketing purposes, which was called into question due to the lack of match with the expectations of the data subjects.
4. Necessity of Treatment and Proportionality
The GDPR states that legitimate interest can be used as a legal basis only if the processing is genuinely necessary for the intended purpose and there are no less invasive alternatives. “Necessity” implies that data handling is directly linked to achieving the purpose and that other, more privacy-friendly options are not viable.
Judgment C-621/22 of the CJEU stresses that data controllers must demonstrate that they have considered other alternatives before justifying processing based on legitimate interest. Likewise, the processing must interfere as little as possible with the rights of individuals, applying principles of minimisation and proportionality.
5. Analysis of the CJEU Judgment in Case C-621/22
Judgment C-621/22 addresses fundamental issues to understand the scope of legitimate interest in the context of the GDPR:
1. How should the concept of “legitimate interest” be understood under the GDPR?
2. Can a purely commercial interest be classified as legitimate in certain circumstances?
The CJEU clarified that a legitimate interest does not need to be explicitly mentioned in the law, but must comply with the principles of lawfulness and be consistent with the reasonable expectations of individuals at the time of the collection of their data. This implies that processing based solely on a commercial interest can be considered legitimate only if the following conditions are met:
Lawfulness: The commercial interest must not infringe any applicable legal provisions.
Need: The processing must be essential to meet the proposed commercial objective.
Proportionality: It should be assessed whether the impact on the rights of data subjects is minimal and whether there is a level of reasonable expectations about the use of their data for this purpose.
In the specific case, the CJEU concluded that the sale of data to a gambling company did not meet the expectations of the data subjects, which invalidated the use of commercial interest as a legal basis.
