The GDPR, among other things, facilitates the processing of personal data. The processing of personal data is allowed only for a good reason prescribed by law – a so-called legal basis. The law provides six such bases, of which “legitimate interest” is one. A legitimate interest requires an evaluation known as a Legitimate Interest Assessment (LIA) to successfully invoke this basis. According to court decisions, this test is necessary to demonstrate that the interest for processing personal data can be considered legitimate enough. The European Court of Justice has ruled that organizations must be able to demonstrate the justification behind their data processing activities through a legitimate interest test (LIA). In this blog post, we will dig into the concept of a Legitimate Interest Assessment and explore its significance in achieving GDPR compliance.

In a nutshell 

• An LIA helps organizations assess if they can process personal data based on a legitimate interest.
• An LIA is a test conducted by organizations to determine if their legitimate interests outweigh the interests, rights, and freedoms of individuals whose personal data they handle.
• When conducting an LIA, define the purpose, necessity, and conduct a balancing test for your legitimate interest.
• After the LIA, evaluate if you can lawfully process data based on a legitimate interest.
• Document the LIA and its results. By documenting this process, you can demonstrate that proper considerations were taken into account to justify the outcome.

Legitimate Interest

Legitimate interest, in the context of data protection, refers to one of the lawful bases for processing personal data under the GDPR. The GDPR’s text on a legitimate interest is shown here below. 

⚖️ Article 6 f GDPR
Processing shall be lawful only if the processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

💡 Example
An organisation has a legitimate interest when the processing takes place within a client relationship, when it processes personal data for direct marketing purposes, to prevent fraud or to ensure the network and information security of the organisations IT systems (source: European Commission).

A legitimate interest can only be a legitimate basis if the interests or fundamental rights and freedoms of the data subject do not outweigh the interest of the organization or a third party.

Legitimate interests will most likely be an appropriate basis where a company use data in ways that people would reasonably expect and that have a minimal privacy impact. Note that when you choose a legitimate interest, it is less likely to be justified when it comes to processing data from children. The interest is often less likely to outweigh the rights and freedoms of children.

Legitimate Interest Assessment

A LIA is a test conducted by organizations to determine whether their legitimate interests outweigh the interests, rights, and freedoms of individuals whose personal data they process. It serves as a tool for organizations to establish if they can process personal data on the basis of a legitimate interest.

The LIA is a three-part test. The test is divided into purpose, necessity and a balancing test. Once all these parts have been completed, an organization can determine if they can process data based on legitimate interest.