- Article 7(f) permits data processing only after balancing the legitimate interests of the controller/third party against the rights of the data subject.
- The opinion provides practical guidance on how to apply Article 7(f) in the existing legal framework and how to carry out the balancing exercise.
- Recommendations are proposed to promote future legal improvements and clarifications in the field of application of Article 7(f).
Opinion 06/2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95/46/EC:
This Opinion analyzes the criteria set down in Article 7 of Directive 95/46/EC for making data processing legitimate. Focusing on the legitimate interests of the controller, it provides guidance on how to apply Article 7(f) under the current legal framework and makes recommendations for future improvements.
Article 7(f) is the last of six grounds for the lawful processing of personal data. In effect it
requires a balancing of the legitimate interests of the controller, or any third parties to whom the data are disclosed, against the interests or fundamental rights of the data subject. The outcome of this balancing test will determine whether Article 7(f) may be relied upon as a legal ground for processing.