Legitimate Interest Is Something You Demonstrate

Over the years, I've heard many excuses for not sending permission-based email. One of the more creative came from a sender in the EU who told me, with complete confidence: "I don't need consent. We have a legitimate interest in marketing our products."

He was right up to a point. The General Data Protection Regulation recognizes "legitimate interest" as a lawful basis for processing personal data, and it names direct marketing as an interest that may qualify.¹ But legitimate interest only works as a conclusion, one you reach after weighing your interests against the rights and freedoms of the people whose data you are using, and you have to be able to show your work.

Legitimate interest has to be demonstrated, not asserted

Legitimate interest gets treated as a catch-all justification because it sounds flexible. The flexibility comes at a price. The controller is responsible for demonstrating compliance with the GDPR's processing principles,² and for legitimate interest that means documenting why the processing is justified. The usual vehicle is a Legitimate Interest Assessment (LIA), which evaluates and records the purpose, the necessity, and the balance. The GDPR doesn't require an LIA by name. Without one, though, you have very little to point to when someone asks you to demonstrate compliance, and that demonstration is required.

The assessment answers three questions, and each one can sink the claim on its own.

A vague purpose fails the first test

The need to process the data must be clearly stated. "We think it would be helpful to us" is not a statement of need. "We want to send marketing messages only to people who would be interested in this product" is specific about why the processing has to happen and what it accomplishes.

Suppose a company is launching a product that fits the interests of a particular customer segment. It can make a case that targeted email is the way to tell those customers about something that could benefit them, and that it has to process their personal data to build the segment. That reasoning has to be written down, and it has to hold up when someone else reads it.

The purpose also has to fit what the people involved would reasonably expect. If the data was collected for something else, using it for marketing is a new purpose that must be compatible with the original one.³ In practice, that usually means the marketing use was clearly communicated at collection and the person had a chance to opt out.

Convenience is not necessity

The processing must be necessary and proportionate to the interest. If the organization can reach the same outcome through less intrusive means, the claim fails. Necessity does not mean the processing is easier. It means the purpose can't reasonably be achieved without it.

That puts the burden on the organization to look at alternatives first. Could aggregated or anonymized data do the job? Could the scope of the processing be narrowed so it touches fewer people or less data? Those questions have to be asked and answered before legitimate interest is the right basis.

The more sensitive the data, the heavier the justification

Finally, weigh the benefit of the processing against the risk to the individual. The benefit must outweigh the risk, and the more sensitive the data, the stronger the benefit has to be.

Religious belief is a good illustration. Processing data that reveals someone's religious beliefs is generally prohibited.⁴ A business can't balance its way around that. A religious body, on the other hand, may process its members' data in the course of its legitimate activities with appropriate safeguards,⁵ and promoting a retreat for those members is the kind of purpose that exception contemplates.

The balance matters most when the person is unlikely to know the processing is happening, or when the impact on them could be significant. If the risks are too high, or the processing is likely to override the person's rights, legitimate interest is off the table, however convenient it would have been.

Legitimate interest can support direct marketing under the GDPR. What it can't do is excuse an organization from the work of showing that its marketing is fair, necessary, and proportionate to the people receiving it. The sender who told me he didn't need consent had skipped that work entirely.

This post does not constitute legal advice. Readers should consult competent legal counsel before taking action based on the analysis presented here.