What legitimate interest requires
Relying on legitimate interest requires a retailer to work through a three-step assessment before the processing starts, and to document it. Three cumulative conditions must be fulfilled: the pursuit of a legitimate interest by the controller or a third party, the necessity of processing personal data for the purposes of that interest, and a finding that the interests or fundamental rights and freedoms of the data subjects do not take precedence 1. The controller must conclude that the interest is legitimate before moving on to the later steps 1.
An interest counts as legitimate only if it meets cumulative criteria 1:
- The interest is lawful, meaning not contrary to EU or Member State law 1.
- The interest is clearly and precisely articulated, so the perimeter of the interest pursued is defined 1.
- The interest is real and present rather than speculative, and, as the CJEU has clarified, must be present and effective at the date of the processing 1.
The third step is the balancing exercise, which identifies and describes the opposing rights and interests at stake and weighs the specific circumstances of the case 1. A legitimate interest may not be invoked with the aim or effect of circumventing legal requirements 1. If a data subject objects on grounds relating to their particular situation, Article 21 GDPR constrains further processing 1. For some direct marketing, a different basis such as consent may be required instead 1.
In practice, a small business relying on legitimate interests for CCTV must record a legitimate-interests assessment showing it considered the purpose, the necessity and the impact on people's privacy 2. Legitimate interest based on security is the basis most commonly used for signage applications in retail and public environments 3.