Glossary A–ZLetter L
Legitimate interest
Legitimate interest is a legal basis under the GDPR that allows personal data to be processed where the controller's interest is not overridden by the rights of the people concerned.
It is set out in Article 6(1)(f). It requires a balancing test in each individual case.
The test has three steps: there must be a legitimate interest, the processing must be necessary for it, and the interests of the people concerned must not prevail. What they can reasonably expect is taken into account. With screens, this basis may come into question for video surveillance or for counting viewers with sensors, for instance, because consent from everyone walking past can hardly be proven.
Legitimate interest is not a blank cheque. The balancing test should be documented in writing, and the people concerned have a right to object. Public authorities cannot rely on it when performing their tasks. The deeper the intrusion, for example with biometric data, the more likely the test is to go against the operator. Whether the basis holds in a particular case should be clarified with the data protection officer; this glossary is not legal advice.