MKB Juristen drafts custom legal documents
It is best not to cobble together or copy important contracts, terms and conditions, and other legal documents yourself. We help entrepreneurs on a budget with customized legal solutions, clear costs upfront, and practical explanations.
- Custom contracts, terms and conditions, and legal documents
- Budget-friendly and clear about the costs upfront
- Request a free consultation or a no-obligation quote
In 2024, the Court of Justice of the EU confirmed that a commercial interest can, under certain circumstances, constitute a 'legitimate interest' within the meaning of the GDPR. Consequently, companies can rely on this basis to process personal data under certain conditions — provided that the processing is necessary and the balancing of interests weighs in their favour.
The basis of 'legitimate interest'
The GDPR requires a legal basis for every processing of personal data (Article 6 GDPR). One of these is legitimate interest: you may process data if this is necessary for a legitimate interest of yourself or a third party, unless the interests or fundamental rights of the data subject outweigh it. For a long time, there was debate as to whether a purely commercial interest could fall under this.
What did the Court rule?
The Court of Justice ruled that a commercial interest can in itself constitute a legitimate interest. Consequently, an interest does not need to be established by law or possess a special status to qualify; a purely business, commercial interest also counts. This is an important clarification for companies wishing to rely on this basis, for example for direct marketing or fraud prevention.
No free pass: the three conditions
The ruling is not a free pass. You must still meet three conditions: there is a legitimate (commercial) interest, the processing is necessary to serve that interest (there is no less intrusive alternative), and the balancing of interests weighs in your favour — the interests and fundamental rights of the data subject do not outweigh yours. You must be able to substantiate that balancing.
What does this mean for you?
If you wish to rely on legitimate interest, document which commercial interest you are serving, why the processing is necessary, and how the balancing of interests turns out. Be transparent with data subjects and offer an opt-out option where necessary. This way, you utilize the scope offered by the ruling without overstepping the boundaries.
Frequently Asked Questions
Can a commercial interest be a legitimate interest under the GDPR?
Yes, according to the Court of Justice, that is possible under certain conditions. An interest does not need to be established by law to qualify.
Am I then allowed to process data for commercial use without further ado?
No. You must demonstrate that there is a legitimate interest, that the processing is necessary, and that the balancing of interests weighs in your favour.
What do I need to record?
The commercial interest, the necessity of the processing and the balancing of interests, plus transparency and, where necessary, an opt-out option.
Want to properly substantiate your foundation?
Our legal experts assess your processing activities and the balancing of interests via a privacy scan. View our privacyteam or schedule a free consultation.
