The European Data Protection Board (EDPB) on 8th October 2024, issued draft Guidelines 1/2024 on processing of personal data based on Article 6(1)(f) of GDPR(Guidelines) and released it for public consultation on 9th October 2024. These guidelines shall remain open for comment until 20th November 2024.
These draft guidelines lay out the conditions for processing personal data based on “legitimate interest,” balanced against the rights of data subjects and in compliance with other provisions of the GDPR. The guidelines provide a detailed framework for assessing when legitimate interest can lawfully justify data processing.
Understanding GDPR’s Article 6(1)(f)
Under the GDPR, the legal basis for processing personal data is provided under Article 6. The six-basis outlined under the GDPR provide lawful grounds for the processing of personal data in compliance with the law. Among them, Article 6(1)(f) refers to the “legitimate interests” of a data controller or third party as a lawful basis for processing, provided that these interests are not overridden by the fundamental rights and freedoms of the data subject, with special emphasis on the data of children. Processing by public authorities is in general excluded from the scope of Article 6(1)(f).
Assessing the Applicability of Article 6(1)(f)
The Guidelines specify three cumulative conditions that must be fulfilled in order to determine whether data can be lawfully processed based on Article 6(1)(f). The listed conditions are as follows:
The pursuit of a legitimate interest by the controller or by a third party
The processing of personal data must be necessary for the purposes of the legitimate interest pursued
The interests or fundamental freedoms and rights of the concerned data subjects do not take precedence over the legitimate interest of the controller or of a third party. For this condition, it is necessary for the controller to evaluate its legitimate interests against the fundamental rights of data subjects in a “balancing exercise” for each processing activity based on legitimate interest.
The Guidelines further provide a three-step assessment to determine the fulfilment of these conditions.
Read Original Article Here > https://tsaaro.com/blogs/draft-edpb-guidelines-on-data-processing-under-article-61f-gdpr-understanding-legitimate-interests/