How Legitimate Is Your Business Interest? The EDPB Has Some Thoughts

Listen to this post

The European Data Protection Board issued draft guidelines last month that outline when processing can be considered done for "legitimate interest." The public has until November 20 to provide comments to the draft.

As most know, under GDPR, legitimate interest is one of the six legal bases for processing personal information. There has been some confusion about what might constitute a legitimate interest, though. And for the EDPB, fear that this has become a default selection companies select without sufficient thought or deliberation. Thus, these draft guidelines. In them, the EDPB provides a three-step approach to assess if a processing activity can be considered done for the company's legitimate interest.