Antonio Tejeda Encinas, CEO, META Channel Corporation; President, CEA Digital Law (Euro-American Committee of Digital Law)
1. Introduction
The processing of personal data in business has changed significantly since the General Data Protection Regulation (GDPR) came into application. One of the most contentious issues is the use of “legitimate interest” as a legal basis for processing data, governed by Article 6(1)(f) GDPR. The recent judgment of the Court of Justice of the European Union (CJEU) in Case C-621/22 has prompted fresh debate on how this concept should be interpreted, particularly in relation to commercial activities.
The purpose of this report is to explore how legitimate interest and commercial interest interact in light of recent case law in the European Union. In addition, practical guidelines are provided for businesses so that they can ensure regulatory compliance without affecting their business objectives.
The GDPR includes legitimate interest as one of the legal bases for processing personal data, but does not define it in detail. Under Article 6(1)(f), processing is lawful if it is carried out to pursue the “legitimate interests” of the controller or a third party, provided that these do not override the fundamental rights and freedoms of the data subject.
This means that determining whether an interest is legitimate requires a contextual assessment based on the principles of reality and specificity. Recitals 47, 48 and 49 GDPR provide guidance, indicating that a legitimate interest must be tangible, present and not merely speculative. This legal basis should therefore be relied on only after careful analysis of the interests involved.
Legitimate interest may cover objectives such as fraud prevention, network and information security or the protection of business assets. However, when it is relied on to justify commercial activities such as marketing or advertising, the assessment becomes stricter, taking into account factors such as foreseeability for the individuals concerned and the transparency of the processing.
Commercial interest, understood as the intention to obtain economic benefits or a competitive advantage, may be acceptable under the GDPR if certain requirements are met. However, the Spanish Data Protection Agency (AEPD) and the Spanish Supreme Court have expressed reservations about allowing such interests to prevail when they conflict with individuals’ fundamental rights.
In its judgment 840/2020, the Supreme Court held that a company’s commercial objectives cannot prevail over the individual’s right to data protection. By contrast, the UK Information Commissioner’s Office (ICO) has taken a more flexible approach, allowing certain processing for commercial purposes provided a rigorous proportionality assessment is carried out.
The CJEU’s judgment in Case C-621/22 addresses this issue, offering guidance on when a commercial interest can be regarded as legitimate. In that case, the interest concerned the disclosure of a sports federation’s members’ personal data to third parties for marketing purposes, which was called into question because it did not match the expectations of the data subjects.
The GDPR provides that legitimate interest can be used as a legal basis only if the processing is genuinely necessary for the stated purpose and there are no less intrusive alternatives. “Necessity” means that the processing is directly linked to achieving the purpose and that other, more privacy-friendly options are not viable.
The CJEU’s judgment in Case C-621/22 stresses that controllers must show that they have considered other alternatives before relying on legitimate interest. The processing must also interfere as little as possible with individuals’ rights, applying the principles of data minimisation and proportionality.
The judgment in Case C-621/22 addresses questions that are fundamental to understanding the scope of legitimate interest under the GDPR:
1. How should the concept of “legitimate interest” be understood under the GDPR?
2. Can a purely commercial interest qualify as legitimate in certain circumstances?
The CJEU clarified that a legitimate interest need not be expressly laid down in law, but it must comply with the principle of lawfulness and be consistent with individuals’ reasonable expectations at the time their data are collected. This means that processing based solely on a commercial interest can be considered legitimate only if the following conditions are met:
Lawfulness: The commercial interest must not infringe any legal provision in force.
Necessity: The processing must be essential to achieving the stated commercial objective.
Proportionality: It must be assessed whether the impact on data subjects’ rights is minimal and whether they could reasonably expect their data to be used for that purpose.
In this specific case, the CJEU concluded that selling the data to a gambling company did not match the data subjects’ expectations, which ruled out commercial interest as a legal basis.
