The European Data Protection Board (EDPB) has adopted new guidelines on the basis of legitimate interest. This is one of six possible bases under the AVG. The EDPB guidelines support companies and institutions in determining whether they may process personal data on the basis of a legitimate interest.
The three conditions for this are that there: actually is a legitimate interest, processing of personal data is necessary to pursue this interest, and the legitimate interest outweighs the interests of data subjects.
The guidelines clarify when it is possible to invoke this basis. They also explain what organizations should consider when justifying their processing using this basis. Among other things, data subjects have special rights when this basis is used. Public consultation for the guidelines is currently taking place. On the EDPB website, anyone can, until November 20, 2024, submit provide feedback on the new guidelines.
The EDPB also published the 2025 work program, adopted a statement on new European legislation for AVG enforcement, and adopted an opinion on the obligations of controllers, processors and sub-processors.
Click here for the new guidelines on legitimate interest.
Click here for the 2025 work program.
