You only have the right to process (ordinary) personal data if you can rely on 1 of the 6 bases in the General Data Protection Regulation (AVG). One of those bases is that the processing of personal data is necessary to pursue your legitimate interest.
Any time you process personal data, it is an invasion of the privacy of the data subjects. Those are the people whose data you are processing. After all, every person has a right to privacy, which is a fundamental right.
But as an organization, you can also have the law on your side. This is the case if you have an interest that society considers so important that it has found recognition in the law. And you can only promote this interest by processing personal data. We call such an interest a legitimate interest.
Clash of rights
A situation then arises in which your right 'clashes' with the fundamental right of the data subjects. It is then up to you to weigh these rights against each other and see what weighs more heavily, your interest or that of the data subjects.
Does your interest ultimately outweigh your interests? Then you may base your processing on the basis of (necessary to serve a) legitimate interest.
See more: How do you test whether you may rely on the legitimate interest basis?
Learn more
