Review of the Regulation of Legitimate Interest as a Legal Basis for Processing and the Relevant Case-law of the Court of Justice of the European Union with Regard to the Concept of Interests Considered as Being Legitimate

Abstract

This study seeks to establish the position that the scope of data controllers’ lawful interests should be interpreted as broadly as possible by reviewing the development of legitimate interest, the legal basis that can be interpreted as the most flexibly regulated, the rules of the General Data Protection Regulation, the opinion of the Article 29 Working Party, the practice of the Court of Justice of the European Union and the guidelines of the European Data Protection Board launched for public consultation recently. This approach should be considered both in view of the concept and obligations of the controller responsible and accountable for data processing and especially in view of the dynamic change of contexts of data processing. Excessive and unfounded reference to legitimate interest can be prevented and at the same time protection of personal data, rights and interests of data subjects can be ensured by carefully balancing interests, for which the rulings of the CJEU and the guidance of EDPB provide criteria to be followed.