The European Data Protection Board (EDPB) has just published its One-Stop-Shop Case Digest on the use of 'Legitimate Interests' as legal basis for processing Personal Data
Key Points to consider
Legitimate interests is one of the six available legal bases provided in Article 6(1) of the General Data Protection Regulation (EU) 2016/679 (the 'GDPR'), and is considered to be one of the most flexible legal bases allowing controllers to process personal data without receiving consent from a data subject, if it is necessary for inter alia business or commercial interests (provided that the individual's rights and fundamental rights are not overridden).
In order to lawfully use the specific legal basis, a three-part test needs to be satisfied:
