Question 8522 — digital

Summary

As the author of the question indicates, legitimate interest is one of the legal bases provided for by European Regulation No. 2016/679 of April 27, 2016 establishing the general regime for the protection of personal data in Europe - known as GDPR - authorizing the implementation of processing of personal data. Legitimate interest is not precisely defined by the GDPR, however the economic interest of a company does not allow not in itself characterize a legitimate interest capable of authorizing the processing of personal data. More precisely, the National Commission for Information Technology and Liberties (CNIL) identifies three criteria so that legitimate interest can constitute the legal basis for the processing of personal data. The interest pursued by the organization must first be legitimate. The CNIL considers that the character legitimate interest can be presumed if three conditions are met: - The interest is manifestly lawful; - It is determined in a sufficiently clear and precise manner; - It is real for the organism concerned, and not fictitious. Then the processing of personal data must be necessary. This implies in particular that the data controller must ensure that there is no less intrusive means for life deprived of achieving this objective than of implementing the envisaged treatment. Finally, the processing must not conflict with the rights and interests of the people whose data is processed, taking into account their reasonable expectations. The data controller must therefore verify that the interests he pursues do not create an imbalance to the detriment of the rights and interests of the people whose data are processed. This balancing of the rights and interests in question must be carried out for each processing operation. Concretely, the CNIL offers a three-step methodology to assess the relevance of legitimate interest as a legal basis for processing personal data: - Identification of the legitimate nature of the interest pursued by the data controller and verification of the necessary nature of the processing in view of this objective; - Assessment attacks on the interests and rights and freedoms of individuals and taking into account their reasonable expectations; - Balancing of these elements and, where appropriate, definition of additional measures.

Machine translation from French. The official text remains authoritative.

Timeline

No timeline events have been ingested for this record yet.

Votes

No vote records are attached yet.

Versions

No version snapshots stored. Document URLs remain at the source.

Documents

No documents linked.

Sponsors

No sponsors or actors listed by the source.

Related records

No cross-record relationships stored yet.