Antonio Tejeda Encinas CEO META Channel Corp. President of the Euro-American Digital Law Committee
1. Introduction
The processing of personal data in the business environment has undergone important transformations with the implementation of the General Data Protection Regulation (GDPR). One of the most controversial issues is the use of “legitimate interest” as a legal basis for handling data, regulated in article 6.1(f) of the GDPR. The recent ruling of the Court of Justice of the European Union (STJEU) in case C-621/22 has generated new discussions on the interpretation of this concept, especially in relation to commercial activities.
The purpose of this report is to explore how legitimate interest and commercial interest interact in light of recent case law in the European Union. In addition, practical guidelines are provided for businesses so that they can ensure regulatory compliance without affecting their business objectives.
The GDPR includes legitimate interest as one of the legal bases for handling personal data, but does not provide a detailed definition. According to article 6.1(f), data processing is legal if it is carried out to satisfy “legitimate interests” of the controller or a third party, provided that these do not override the fundamental rights and freedoms of the person whose data is processed.
This implies that, to determine whether an interest is legitimate, a contextual evaluation is required, based on the principles of realism and specificity. Recitals 47, 48 and 49 of the GDPR offer guidelines, indicating that the legitimate interest must be tangible, current and not merely speculative. Thus, the application of this legal basis must be carried out after carefully analyzing the interests involved.
Legitimate interest may include objectives such as fraud prevention, security of network systems, or protection of business assets. However, when seeking to justify commercial activities, such as marketing or advertising, the evaluation becomes stricter, considering factors such as predictability for those affected and the transparency of the processes.
Commercial interest, understood as the intention to obtain economic benefits or a competitive advantage, may be acceptable under the GDPR if certain requirements are met. However, the Spanish Data Protection Agency (AEPD) and the Supreme Court of Spain have expressed reservations regarding the prevalence of these interests when they conflict with the fundamental rights of individuals.
In its ruling 840/2020, the Supreme Court stated that the commercial objectives of a company cannot prevail over the individual’s right to data protection. Instead, the UK Information Commissioner’s Office (ICO) has adopted a more flexible approach, allowing certain processing for commercial purposes if a rigorous proportional assessment is carried out.
The CJEU Judgment in case C-621/22 addresses this issue, providing guidance on when a commercial interest can be considered legitimate. In that case, the interest referred to the transfer of personal data of the members of a sports federation to third parties for marketing purposes, which was questioned due to the lack of adaptation to the expectations of the interested parties.
The GDPR establishes that legitimate interest can be used as a legal basis only if the treatment is really necessary for the stated objective and there are no less invasive alternatives. “Need” implies that data management is directly linked to achieving the purpose and that other more privacy-friendly options are not viable.
The CJEU ruling C-621/22 highlights that data controllers must demonstrate that they have considered other alternatives before justifying processing based on legitimate interest. Likewise, the treatment must interfere as little as possible with the rights of people, applying principles of minimization and proportionality.
Ruling C-621/22 addresses fundamental issues to understand the scope of legitimate interest in the context of GDPR:
1. How should the concept of “legitimate interest” be understood under the GDPR?
2. Can a purely commercial interest be qualified as legitimate in certain circumstances?
The CJEU clarified that a legitimate interest does not need to be explicitly mentioned in the law, but must comply with the principles of legality and be consistent with the reasonable expectations of individuals at the time of collecting their data. This implies that processing based exclusively on a commercial interest can be considered legitimate only if the following conditions are met:
Legality: The commercial interest must not infringe any current legal provision.
Necessity: The treatment must be essential to meet the stated commercial objective.
Proportionality: It must be evaluated whether the impact on the rights of the interested parties is minimal and if there is a level of reasonable expectations regarding the use of their data for this purpose.
In the specific case, the CJEU concluded that the sale of data to a gambling company did not comply with the expectations of the interested parties, which invalidated the use of commercial interest as a legal basis.
