EDPB Publishes Draft Guidelines On Legitimate Interests

The European Data Protection Board ("EDPB") recently published draft Guidelines 1/2024 concerning the processing of personal data based on legitimate interests under Article 6(1)(f) GDPR (the "Guidelines"). The Guidelines were subject to public consultation until 20 November 2024.

The Guidelines build on and update the previous Working Party Opinion 06/2014 on legitimate interests in light of the GDPR, and rulings by the Court of Justice of the European Union ("CJEU"). They consider how a legitimate interests assessment ("LIA") should be carried out in practice, including in certain specific contexts such as fraud prevention, direct marketing, information security, where legitimate interests may be considered as a lawful basis.