Legitimate interest and commercial interest under the GDPR in the light of the CJEU’s judgment in Case C-621/22

Antonio Tejeda Encinas. CEO, Meta Channel Corp. President of the Euro-American Committee of Digital Law - CEA Digital Law

1. Introduction

The processing of personal data in business has undergone major changes with the implementation of the General Data Protection Regulation (GDPR). One of the most controversial issues is the use of ‘legitimate interest’ as a legal basis for handling data, governed by Article 6(1)(f) of the GDPR. The recent judgment of the Court of Justice of the European Union (CJEU) in Case C-621/22 has sparked fresh debate on how this concept should be interpreted, especially in relation to commercial activities.

The purpose of this report is to explore how legitimate interest and commercial interest interact in the light of recent EU case law. It also offers practical guidance for businesses, so that they can ensure regulatory compliance without undermining their commercial objectives.

2. The concept of legitimate interest in the GDPR

The GDPR includes legitimate interest as one of the legal bases for handling personal data, but does not define it in detail. Under Article 6(1)(f), processing is lawful if it is carried out to pursue the ‘legitimate interests’ of the controller or of a third party, provided that those interests do not override the fundamental rights and freedoms of the person whose data are being processed.

This means that determining whether an interest is legitimate requires a contextual assessment based on the principles of reality and specificity. Recitals 47, 48 and 49 of the GDPR provide guidance, indicating that a legitimate interest must be tangible, present and not merely speculative. This legal basis should therefore be relied on only after a careful analysis of the interests at stake.

Legitimate interest may cover objectives such as fraud prevention, network security or the protection of business assets. However, when it is used to justify commercial activities such as marketing or advertising, the assessment becomes stricter, taking into account factors such as how foreseeable the processing is for those affected and how transparent the processes are.

3. The relationship between legitimate interest and commercial interest

Commercial interest, understood as the aim of making a profit or gaining a competitive advantage, may be acceptable under the GDPR if certain requirements are met. However, the Spanish Data Protection Agency (AEPD) and Spain’s Supreme Court (Tribunal Supremo) have expressed reservations about such interests prevailing when they conflict with individuals’ fundamental rights.

In its judgment 840/2020, the Supreme Court held that a company’s commercial objectives cannot override an individual’s right to data protection. By contrast, the UK’s Information Commissioner’s Office (ICO) has taken a more flexible approach, allowing certain processing for commercial purposes provided that a rigorous proportionality assessment is carried out.

The CJEU’s judgment in Case C-621/22 addresses this issue, providing guidance on when a commercial interest can be regarded as legitimate. In that case, the interest concerned the disclosure of the personal data of members of a sports federation to third parties for marketing purposes, which was called into question because it did not match the data subjects’ expectations.

4. Necessity of processing and proportionality

Under the GDPR, legitimate interest can be used as a legal basis only if the processing is genuinely necessary for the stated purpose and there are no less intrusive alternatives. ‘Necessity’ means that the processing is directly linked to achieving the purpose and that other, more privacy-friendly options are not viable.

The CJEU’s judgment in C-621/22 stresses that controllers must show that they have considered other alternatives before justifying processing on the basis of legitimate interest. In addition, the processing must interfere as little as possible with individuals’ rights, in line with the principles of data minimisation and proportionality.

5. Analysis of the CJEU judgment in Case C-621/22

Judgment C-621/22 addresses questions that are fundamental to understanding the scope of legitimate interest under the GDPR:

1. How should the concept of ‘legitimate interest’ under the GDPR be understood?

2. Can a purely commercial interest qualify as legitimate in certain circumstances?

The CJEU made clear that a legitimate interest need not be expressly provided for by law, but it must comply with the principle of lawfulness and be consistent with individuals’ reasonable expectations at the time their data are collected. It follows that processing based solely on a commercial interest can be regarded as legitimate only if the following conditions are met:

Lawfulness: The commercial interest must not breach any legal provision in force.

Necessity: The processing must be indispensable to achieving the commercial objective pursued.

Proportionality: It must be assessed whether the impact on the data subjects’ rights is minimal and whether they could reasonably expect their data to be used for that purpose.

In this particular case, the CJEU concluded that selling the data to a gambling company did not match the data subjects’ expectations, which ruled out commercial interest as a legal basis.