In accordance with applicable data protection regulations and interpretations, when processing personal data based on legitimate interests, as defined in Article 6(1)(f) of the GDPR, a mechanism known as the balancing test must be applied. This basis is often used, among other things, for direct marketing, the exchange of personal data between entities within groups of companies, fraud prevention, claims enforcement, and monitoring. This extremely flexible legal basis for data processing is essential to avoid legal absurdities, but it must not be abused. Recital 4 of the GDPR indicates the need to ensure a balance between the interests and rights of legal participants.
Who and when do I do the balance test?
The balancing test should be carried out in particular for the controller as part of the risk-by-approach, giving the organization a guarantee of the legality of a given personal data processing process.
The balancing test is also necessary during a potential UODO inspection in order to be able to demonstrate, under the accountability principle, why the interests of the data controller outweigh the rights and freedoms of the data subject.
What should a balance test look like?
The balancing test aims to limit the abuse of this legal basis for processing personal data. Currently, there are numerous methodologies and tools for performing the balancing test.
It is important to remember that when applying the balancing test, it is necessary to first assess whether the controller's or third party's legitimate interest in data processing is actually justified. Another issue requiring verification is whether processing is necessary to achieve the purpose stemming from that interest. The final step in the verification should be to verify whether the interests or fundamental rights and freedoms of the data subject do not outweigh the legitimate interest of the controller or third party.
Test result – what next?
If the above analysis shows that the interests, rights and freedoms of the data subjects override the legitimate interest of the Controller, it is necessary to discontinue the processing or not to start the planned personal data processing.
However, if the Controller's legitimate interest overrides the interests, rights, and freedoms of data subjects, the relevant processing basis must be applied to comply with the Controller's legal obligations. In accordance with the accountability principle, the balancing test must be documented and the information obligation must be fulfilled. The information obligation should also include information that the data subject can obtain information regarding the balancing test upon request. The information should be formulated clearly and transparently, including an explanation of the purpose, necessity, balance, and outcome of the test.
This article is for informational purposes only and does not constitute legal advice.
Legal status as of October 5, 2022.
author/editor of the series:
