Legitimate Interest Lia

Performing Legitimate Interest Assessment

Overview

When a controller relies on Art. 6(1)(f) as the lawful basis for processing, a Legitimate Interest Assessment (LIA) must be conducted and documented before processing begins. The LIA consists of three sequential tests derived from the wording of Art. 6(1)(f) and elaborated in WP29 Opinion 06/2014. If any test fails, legitimate interest cannot be relied upon, and an alternative lawful basis must be found or processing must not proceed.

Part 1: Purpose Test

The purpose test establishes whether the controller (or a third party) has a legitimate interest that is real, lawful, and clearly articulated.

Assessment Criteria

1. Identify the interest: What specific interest does the controller or third party pursue? The interest must be concrete and articulated, not vague or hypothetical.

2. Verify legitimacy: The interest must be:

   • Lawful (not prohibited by any law)
   • Sufficiently specific to be assessed
   • Real and present (not speculative or future)
   • Consistent with what data subjects would reasonably expect

3. Common legitimate interests recognised by the GDPR:

   • Fraud prevention (Recital 47)
   • Direct marketing to existing customers (Recital 47)
   • Network and information security (Recital 49)
   • Intra-group transfers for internal administrative purposes (Recital 48)
   • Reporting possible criminal acts or threats to public security (Recital 50)

4. Document the interest: State the interest in a single clear sentence that could be understood by a non-expert.

Purpose Test Outcome

• PASS: A legitimate interest has been clearly identified and is lawful.
• FAIL: No legitimate interest can be articulated, or the interest is prohibited by law. Stop the assessment — Art. 6(1)(f) cannot be relied upon.

Part 2: Necessity Test

The necessity test determines whether the specific processing is necessary to achieve the identified legitimate interest. This is not a test of whether the interest itself is necessary, but whether the processing is necessary for the interest.

Assessment Criteria

1. Could the interest be achieved without processing personal data? If the same outcome can be reached without personal data, the processing fails the necessity test.

2. Could the interest be achieved with less personal data? Apply data minimisation — only the minimum data necessary should be processed.

3. Could the interest be achieved with a less intrusive method? Consider alternatives:

   • Anonymisation or aggregation instead of identifiable data
   • Pseudonymisation to reduce impact
   • Shorter retention periods
   • More limited sharing
   • Technical restrictions on access

4. Is the processing proportionate to the interest? The scope and intensity of processing should be proportionate to the significance of the interest.

Necessity Test Outcome

• PASS: The processing is necessary for the legitimate interest, no less intrusive alternative achieves the same result, and the scope is proportionate.
• FAIL: A less intrusive alternative exists, or the processing scope exceeds what is necessary. Modify the processing to meet the necessity test, or stop — Art. 6(1)(f) cannot be relied upon.

Part 3: Balancing Test

The balancing test weighs the controller's legitimate interest against the interests, fundamental rights, and freedoms of data subjects. This is the most complex and contextual part of the LIA.

Factors Favouring the Controller

• The interest is strong and compelling (e.g., fraud prevention, security)
• Processing has minimal impact on data subjects
• Data subjects would reasonably expect the processing
• There is an existing relationship between controller and data subject
• Robust safeguards are in place (pseudonymisation, encryption, access controls)
• Data subjects have an easy and effective opt-out mechanism
• Processing uses non-sensitive data
• Data is not shared with third parties
• The controller is transparent about the processing