Regulation and data
Legitimate interest
Legitimate interest is the legal basis in art. 6.1.f of the GDPR: it allows processing when necessary for an interest of the controller or a third party, unless the person's rights and interests override it, especially if they are a child. Public authorities cannot use it when performing their tasks.
Also known aslegitimate interests of the controller · article 6.1.f · interés legítimo
What holds it up
It is not the drawer for whatever fits no other basis. The wording of art. 6.1.f of the GDPR breaks down into three questions the centre should be able to answer in writing, and recital 47 adds the yardstick: what the person can reasonably expect given their relationship with the controller.
- What interest does it pursue? A specific, lawful one: the safety of the building, knowing whom to call in an emergency.
- Is this processing necessary to achieve it, or would fewer data or another means do?
- Do the person's interests override it? An adult resident expects the centre to keep an emergency contact; not to tell their family what hours they keep.
Worth knowing
Whoever relies on it has to say so and accept objections. The information given when collecting the data has to name the specific interest (art. 13.1.d), and the person may object on grounds relating to their particular situation: the centre stops processing their data unless it shows compelling legitimate grounds that override them or needs them for a legal claim (art. 21.1). Spain's LOPDGDD presumes it in some cases, such as the business contact details of someone who works for a supplier (art. 19). The other five bases are under legal basis.
Sources
Related terms
- GDPRThe GDPR is Regulation (EU) 2016/679, the EU rule that governs the processing of personal data. It has applied directly since 25 May 2018, and in Spain the LOPDGDD completes it. It binds a colegio mayor, a private student residence and a coliving in exactly the same way.
- Legal basis for processingThe legal basis, or lawful basis, is what makes it lawful to process personal data. Art. 6.1 of the GDPR allows six: consent, contract, legal obligation, vital interests, a public-interest task or official authority, and legitimate interest. Without one of them, processing is unlawful however useful it is.