{"id":118367,"date":"2024-10-07T17:26:00","date_gmt":"2024-10-07T15:26:00","guid":{"rendered":"https:\/\/ceadigilaw.org\/interes-legitimo-y-comercial-en-el-rgpd-a-la-luz-de-la-sentencia-c-621-22-del-tjue\/"},"modified":"2026-07-17T21:34:23","modified_gmt":"2026-07-17T19:34:23","slug":"interes-legitimo-y-comercial-en-el-rgpd-a-la-luz-de-la-sentencia-c-621-22-del-tjue","status":"publish","type":"post","link":"https:\/\/ceadigilaw.org\/en\/blog\/interes-legitimo-y-comercial-en-el-rgpd-a-la-luz-de-la-sentencia-c-621-22-del-tjue\/","title":{"rendered":"Legitimate interest and commercial interest under the GDPR in the light of the CJEU\u2019s judgment in Case C-621\/22"},"content":{"rendered":"

Antonio Tejeda Encinas<\/a><\/strong>. CEO, Meta Channel Corp<\/a><\/strong>. President of the Euro-American Committee of Digital Law - CEA Digital Law<\/span><\/p>\n

1. Introduction<\/span><\/h4>\n

The processing of personal data in business has undergone major changes with the implementation of the General Data Protection Regulation (GDPR). One of the most controversial issues is the use of \u2018legitimate interest\u2019 as a legal basis for handling data, governed by Article 6(1)(f) of the GDPR. The recent judgment of the Court of Justice of the European Union (CJEU) in Case C-621\/22 has sparked fresh debate on how this concept should be interpreted, especially in relation to commercial activities.<\/span><\/p>\n

The purpose of this report is to explore how legitimate interest and commercial interest interact in the light of recent EU case law. It also offers practical guidance for businesses, so that they can ensure regulatory compliance without undermining their commercial objectives.<\/span><\/p>\n

2. The concept of legitimate interest in the GDPR<\/span><\/h4>\n

The GDPR includes legitimate interest as one of the legal bases for handling personal data, but does not define it in detail. Under Article 6(1)(f), processing is lawful if it is carried out to pursue the \u2018legitimate interests\u2019 of the controller or of a third party, provided that those interests do not override the fundamental rights and freedoms of the person whose data are being processed.<\/span><\/p>\n

This means that determining whether an interest is legitimate requires a contextual assessment based on the principles of reality and specificity. Recitals 47, 48 and 49 of the GDPR provide guidance, indicating that a legitimate interest must be tangible, present and not merely speculative. This legal basis should therefore be relied on only after a careful analysis of the interests at stake.<\/span><\/p>\n

Legitimate interest may cover objectives such as fraud prevention, network security or the protection of business assets. However, when it is used to justify commercial activities such as marketing or advertising, the assessment becomes stricter, taking into account factors such as how foreseeable the processing is for those affected and how transparent the processes are.<\/span><\/p>\n

3. The relationship between legitimate interest and commercial interest<\/span><\/h4>\n

Commercial interest, understood as the aim of making a profit or gaining a competitive advantage, may be acceptable under the GDPR if certain requirements are met. However, the Spanish Data Protection Agency (AEPD) and Spain\u2019s Supreme Court (Tribunal Supremo) have expressed reservations about such interests prevailing when they conflict with individuals\u2019 fundamental rights.<\/span><\/p>\n

In its judgment 840\/2020, the Supreme Court held that a company\u2019s commercial objectives cannot override an individual\u2019s right to data protection. By contrast, the UK\u2019s Information Commissioner\u2019s Office (ICO) has taken a more flexible approach, allowing certain processing for commercial purposes provided that a rigorous proportionality assessment is carried out.<\/span><\/p>\n

The CJEU\u2019s judgment in Case C-621\/22 addresses this issue, providing guidance on when a commercial interest can be regarded as legitimate. In that case, the interest concerned the disclosure of the personal data of members of a sports federation to third parties for marketing purposes, which was called into question because it did not match the data subjects\u2019 expectations.<\/span><\/p>\n

4. Necessity of processing and proportionality<\/span><\/h4>\n

Under the GDPR, legitimate interest can be used as a legal basis only if the processing is genuinely necessary for the stated purpose and there are no less intrusive alternatives. \u2018Necessity\u2019 means that the processing is directly linked to achieving the purpose and that other, more privacy-friendly options are not viable.<\/span><\/p>\n

The CJEU\u2019s judgment in C-621\/22 stresses that controllers must show that they have considered other alternatives before justifying processing on the basis of legitimate interest. In addition, the processing must interfere as little as possible with individuals\u2019 rights, in line with the principles of data minimisation and proportionality.<\/span><\/p>\n

5. Analysis of the CJEU judgment in Case C-621\/22<\/span><\/h4>\n

Judgment C-621\/22 addresses questions that are fundamental to understanding the scope of legitimate interest under the GDPR:<\/span><\/p>\n

1. How should the concept of \u2018legitimate interest\u2019 under the GDPR be understood?<\/span><\/p>\n

2. Can a purely commercial interest qualify as legitimate in certain circumstances?<\/span><\/p>\n

The CJEU made clear that a legitimate interest need not be expressly provided for by law, but it must comply with the principle of lawfulness and be consistent with individuals\u2019 reasonable expectations at the time their data are collected. It follows that processing based solely on a commercial interest can be regarded as legitimate only if the following conditions are met:<\/span><\/p>\n

Lawfulness:<\/strong> The commercial interest must not breach any legal provision in force.<\/span><\/p>\n

Necessity:<\/strong> The processing must be indispensable to achieving the commercial objective pursued.<\/span><\/p>\n

Proportionality:<\/strong> It must be assessed whether the impact on the data subjects\u2019 rights is minimal and whether they could reasonably expect their data to be used for that purpose.<\/span><\/p>\n

In this particular case, the CJEU concluded that selling the data to a gambling company did not match the data subjects\u2019 expectations, which ruled out commercial interest as a legal basis.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Antonio Tejeda Encinas. CEO, Meta Channel Corp. President of the Euro-American Committee of Digital Law - CEA Digital Law 1. Introduction The processing of personal data in business has undergone major changes with the implementation of the General Data Protection Regulation (GDPR). One of the most controversial issues is the use of \u2018legitimate interest\u2019 as […]<\/p>\n","protected":false},"author":2,"featured_media":112317,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"wds_primary_category":0,"wds_primary_cea_women":0,"footnotes":""},"categories":[1107],"tags":[],"cea_women":[],"class_list":["post-118367","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection-privacy"],"acf":[],"_links":{"self":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/comments?post=118367"}],"version-history":[{"count":1,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118367\/revisions"}],"predecessor-version":[{"id":119448,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/posts\/118367\/revisions\/119448"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media\/112317"}],"wp:attachment":[{"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/media?parent=118367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/categories?post=118367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/tags?post=118367"},{"taxonomy":"cea_women","embeddable":true,"href":"https:\/\/ceadigilaw.org\/en\/wp-json\/wp\/v2\/cea_women?post=118367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}