This Opinion analyzes the principles set forth in Article 7 of Directive 95/46/EC regarding the permissibility of data processing. The opinion focuses mainly on the legitimate interest of the data controller and provides guidance on the application of Article 7(f) in accordance with the current legal framework. The opinion also contains recommendations for future improvements.
Article 7(f) is the last of six grounds for lawful processing of personal data. In effect, the provision requires a balancing of the legitimate interest of the controller or any third party to whom the data are disclosed against the interest or fundamental rights of the data subject. The outcome of this balancing of interests determines whether Article 7(f) may be used as a legal ground for processing.
The Article 29 Data Protection Working Party recognizes the importance and usefulness of the criterion expressed in Article 7(f) which, under the right circumstances and provided that appropriate safeguards are in place, can help avoid over-reliance on other legal grounds. Article 7(f) should not be seen as a "last resort" for rare or unexpected situations where other grounds for justified processing are considered inapplicable. However, this ground should not be automatically chosen, nor should its use be unreasonably extended based on the perception that it is less restrictive than the other grounds.
A proper assessment under Article 7(f) is not merely a balancing exercise consisting solely of balancing two easily qualified and comparable interests. Rather, this balancing must fully consider a number of factors to ensure that the interest and fundamental rights of data subjects are adequately taken into account. At the same time, this balancing is flexible in the sense that it can range from simple to complex and should not be unreasonably burdensome. Factors to be considered in the balancing process include:
- the nature and source of the legitimate interest and whether the data processing is necessary for the exercise of a fundamental right, otherwise serves the public interest or enjoys recognition in the relevant community;
- the impact on the data subject and their reasonable expectations about what will happen to their data, as well as the nature of the data and how it will be processed;
- additional safeguards that may limit unwanted consequences for the data subject, such as data minimization, privacy-enhancing technologies, improved transparency, the general and unconditional right to "opt-out," and data portability.
For the future, the Article 29 Data Protection Working Party recommends adding a recital to the proposed regulation on the main factors to be taken into account in the balancing exercise. The Article 29 Data Protection Working Party also recommends that a recital be added requiring the controller, where appropriate, to document its assessment in the interest of better accountability. Finally, the Article 29 Data Protection Working Party 4 also supports a substantive provision that data controllers should explain to data subjects why they consider that their interest prevails over the interest, fundamental rights and freedoms of the data subject.
