In the response to a GDPR Data Subject Access Request, in describing the lawful basis under which the data controller is processing my data, I got this:

We process your personal data for our legitimate interests including:

  • to enforce compliance with our Terms of Use and applicable law.
  • to protect the rights and safety of our Members and third parties.
  • to meet legal requirements.
  • to provide information to representatives and advisors to help us comply with legal, accounting or security requirements.
  • to prosecute and defend legal proceedings.
  • to respond to lawful requests by public authorities.
  • to provide, support and improve our Services.
  • for our data analytics projects.

Is this a complete answer to the question, or can I require them to detail exactly what justifies them gaining this legitimate interest? There is nothing in anything else they have sent that would indicate a justification to my non-lawyer eyes.

1 Answer 1


When responding to a DSAR (Art 15), the controller must list the purposes for which the personal data is being processed.

When obtaining personal data (Art 13 & 14), the controller must inform the data subject about the intended purposes of processing, the legal basis, and if the legal basis is a legitimate interest, those legitimate interests pursued by the controller or a third party.

Usually, this information is combined into a single document and then published as a privacy policy, to which the data subject is referred when responding to a DSAR.

I cannot find a reason to provide further justification on the legitimate interests. However, in the Guidelines on Transparency, the WP29 (adopted by the EDPB) write:

The specific interest in question must be identified for the benefit of the data subject. As a matter of best practice, the controller can also provide the data subject with the information form the balancing test, which must be carried out to allow reliance on Article 6.1(f) as a lawful basis for processing, in advance of any collection of data subjects' personal data. To avoid information fatigue, this can be included within a layered privacy statement/ notice (see paragraph 35). In any case, the WP29 position is that information to the data subject should make it clear that they can obtain information on the balancing test on request. This is essential for effective transparency where data subjects have doubts as to whether the balancing test has been carried out fairly or they wish to file a complaint with a supervisory authority.

– WP29 (2018): Guidelines on Transparency under Regulation 2016/679. WP260 rev.01. URL https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227

So the WP29/EDBP is of the opinion that data subjects are entitled to get the controller's balancing test (sometimes also called a legitimate interest assessment). I can see no explicit legal basis for this interpretation, and it can just be inferred indirectly from the more general transparency principle or accountability principle. I am not necessarily convinced this interpretation would be upheld by a court.

The ICO instead sees a more limited scope:

You must tell individuals:

  • what your purpose for processing personal data is;
  • that you are relying on legitimate interests as your lawful basis; and
  • summarise what the relevant legitimate interests are.

– ICO: Legitimate interests: What else do we need to consider? In: Guide to the General Data Protection Regulation (GDPR). URL: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-else-do-we-need-to-consider/

A summary of the legitimate interests points to a fairly terse list similar to that which you have shown.

Note that in the given list of alleged legitimate interests, there are some odd entries such as “to meet legal requirements”. This indicates Art 6(1)(f) legitimate interest is incorrect, and Art 6(1)(c) legal obligation should be used instead as the legal basis, unless the legal requirement does not stem from EU or member state law. Also, any “advisors” should instead be bound as data processors, which would make it unnecessary to find a legal basis to share personal data with them. “Data analytics projects” is incredibly vague, and not a legitimate interest unless the data analysis is performed for achieving another purpose such as to “improve our Services”.

  • Is trying to avoid falling under scope of a law which section ? Commented Feb 1, 2021 at 4:37
  • @scientist I'm not sure what you're asking?
    – amon
    Commented Feb 1, 2021 at 7:04
  • I mean if a person processes data he can avoid following a certain law but if he does not he must follow the law. Like geoblocking where copyright is not owned. Commented Feb 1, 2021 at 13:31
  • @scientist Are you asking how a data controller could avoid being subject to the GDPR? Non-EU data controllers can avoid offering goods or services to people in the EU which would achieve that. Geoblocking is one way to do that, though less drastic means are probably sufficient as well. But all of this seems quite unrelated to the question main.
    – amon
    Commented Feb 1, 2021 at 18:15
  • No not about that I am saying that say we do not have rights on a text in a region or country in E.U. so we process data to determine country of user. What article does this fall under. Commented Feb 1, 2021 at 18:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .