The guidance on this subject is somewhat slim. Ultimately, disagreement about a legitimate interest balancing test will have to be decided by a court.
The GDPR allows processing activities if
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
(Art 6(1)(f) GDPR)
Details are given in Recital 47, which suggests that the balancing test must consider “the reasonable expectations of data subjects based on their relationship with the controller”:
1The legitimate interests of a controller, including those of a controller to which the personal data may be disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable expectations of data subjects based on their relationship with the controller.
2Such legitimate interest could exist for example where there is a relevant and appropriate relationship between the data subject and the controller in situations such as where the data subject is a client or in the service of the controller.
3At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.
4The interests and fundamental rights of the data subject could in particular override the interest of the data controller where personal data are processed in circumstances where data subjects do not reasonably expect further processing.
5[…].
6The processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned.
7The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest.
The EDPB's predecessor WP29 issued an opinion on legitimate interests in 2014 (document WP-217, PDF link). While this relates to the old Data Protection Directive rather than to the GDPR, the general concepts should be transferable.
For the UK, the ICO has issued the guidance linked in the question. It contains an explanation of a three-part test developed from case law (purpose – necessity – balancing), provides various examples, and suggests a number of questions that can be used to start a legitimate interest balancing test. For example, to assess the reasonable expectations of the data subject, the following prompts are given:
You need to consider whether people will reasonably expect you to use their data in this way in the particular circumstances.
You should consider all relevant factors, including:
- Do you have an existing relationship with the individual? If so, what is the nature of that relationship?
- How have you used their data in the past?
- Did you collect data directly from the individual?
- What did you tell individuals at the time?
- If you obtained the data from a third party, what did they tell individuals about reuse of the data by third parties for other purposes?
- How long ago was the data collected? Are there any changes in technology or other context since that time that would affect current expectations?
- Is your intended purpose and method obvious or widely understood?
- Are you intending to do anything new or innovative?
- Do you have any actual evidence about expectations, eg from market research, focus groups or other forms of consultation?
- Are there any other factors in the particular circumstances that mean they would or would not expect the processing?
This is an objective test.
You do not have to show that every individual does in fact expect you to use their data in this way.
Instead, you have to show that a reasonable person would expect the processing in light of the particular circumstances.
The ICO guidance is, to my knowledge, the best and most up to date publicly available resource on this matter.
You are right to be frustrated about the current use of legitimate interests in typical consent management frameworks for tracking or advertising purposes. There is the perverse but technically correct argument that since advertising and tracking is so common, that a data subject must reasonably expect it on typical websites. On the other hand, there is no “relevant and appropriate relationship between the data subject and the controller” where the data controllers are hundreds of third parties in the depths of the advertising, tracking, and data brokering industries.
My assumption is that the current state of internet advertising through the use of large advertising networks is not GDPR compliant. The legitimate interests claimed in consent management tools are often extremely spurious. To be clear, direct marketing and showing ads is probably perfectly fine, but sharing the information with an indeterminate number of third parties is probably not. While such sharing is necessary given the current state of advertising networks, the sharing is not fundamentally necessary for advertising.
The individual publishers are not necessarily to blame. Sure, they are data controllers and are at least jointly responsible for whatever happens on their websites. But the abuse of legitimate interests for internet advertising purposes is more of a systemic problem. I would lay a lot of the blame on the Internet Advertising Bureau (IAB) which standardizes data models and vendor lists for consent management tools. These lists are sometimes copied by publishers in a false sense of security.
The GDPR has no explicit right to demand access to internal compliance documents such as a legitimate interest analysis. Supervisory authorities are clearly authorized to access such documents during an investigations. Data subject could instead invoke the Art 5(2) accountability principle:
The controller shall be responsible for, and be able to demonstrate compliance with, paragraph 1 (‘accountability’).
The paragraph 1 of Art 5 contains, among other principles, the lawfulness principle. Relying on a legitimate interest per Art 6(1)(f) can be lawful, so that demonstrating compliance could require disclosure of the legitimate interest analysis. This interpretation seems to be commonly shared by supervisory authorities and is occasionally implied by EDPB guidelines, but there has yet to be official guidance or a clear court judgement on this matter.
