The use of Legitimate Interests as a legal ground for processing personal data under the EU General Data Protection Regulation poses a number of questions – When might they apply? How do you balance your interests with the fundamental rights and freedoms of individuals? And how can you effectively communicate your use of Legitimate Interests and uphold the right to object to processing under these grounds?
The answers are to be found in guidance being produced by a Legitimate Interests Working Party set up by the Data Protection Network, founded by Opt-4’s Rosemary Smith and Jenny Moseley. The DPN’s initiative has been made possible by contributions from the Incorporated Society of British Advertisers, the Direct Marketing Association and data protection and privacy specialists from some of the largest companies and institutions in the UK.
The Information Commissioner, Elizabeth Denham, has warmly welcomed the group’s work and a draft of the guidance has recently been submitted to the Regulator for review and comment. It has also been submitted to the Data Protection Commissioner in Ireland. (View the DPN’s Legitimate Interests Guidance published July 2017)
The purpose of the DPN’s guidance is to help commercial and not-for-profit organisations understand the circumstances in which Legitimate Interests may apply and aims to provide practical advice on meeting the crucial “Balance of Interests Condition”.
The intention is to create a framework that Controllers can apply to their own specific circumstances. It covers how to conduct and document Legitimate Interests Assessments and offers advice on how best to articulate and inform individuals, using fair processing notices, about the circumstances in which their Personal Data may be processed under LI.
It’s hoped that if the guidance is widely adopted, it will provide a consistent approach for the benefit of both organisations and individuals.
“A cross-industry guide to using the Legitimate Interests condition to lawfully process personal data is both timely and necessary in order to support the work of the ICO in creating practical advice on consent and other lawful data processing mechanisms both now and under GDPR.”
Robert Bond, Partner at Bristows LLP & Chairman of the DPN Legitimate Interests Working Group
“Brands preparing for GDPR are keen to understand when they can rely on the Balance of Interests for processing. Agreement to this Guidance from the ICO would be a major step forward.”
Rosemary Smith, DPN Co-founder & Owner of data compliance and marketing permissions consultancy Opt-4