DSK: legi­ti­ma­te inte­rest in asset deals

The Ger­man Con­fe­rence of Inde­pen­dent Federal and Sta­te Data Pro­tec­tion Aut­ho­ri­ties (DSK) has addres­sed the que­sti­on under which cir­cum­stan­ces data pro­ces­sing in asset deals is in a legi­ti­ma­te inte­rest wit­hin the mea­ning of Art. 6(1)(f). It has defi­ned a num­ber of case groups for this pur­po­sein which, in its opi­ni­on, the­re is a legi­ti­ma­te inte­rest (which is not oppo­sed by over­ri­ding con­flic­ting inte­rests of the data subjects):

  • Custo­mer data for cur­rent con­tracts, if the custo­mer appro­ves the trans­fer of the contract;
  • Exi­sting custo­mers without cur­rent con­tracts and last con­trac­tu­al rela­ti­ons­hip older than 3 years: here the acqui­rer should be allo­wed to use the data for archi­ving pur­po­ses only;
  • poten­ti­al custo­mers with “advan­ced con­tract initia­ti­on” and exi­sting custo­mers without cur­rent con­tracts and last con­trac­tu­al rela­ti­ons­hip youn­ger than 3 years: in this case, the acqui­rer should inform the custo­mers of the trans­fer and grant them a “generous” objec­tion peri­od; if the­re is no objec­tion, the acqui­rer may use the data (exclu­ding bank data) productively;
  • Custo­mer data at out­stan­ding receiva­bles: Receiva­bles may be transmitted;
  • Spe­cial cate­go­ries of per­so­nal data: The trans­fer is only per­mit­ted with consent.

The posi­ti­on of the DSK – which the aut­ho­ri­ties of Sax­o­ny and Ber­lin have not fol­lo­wed – is hard­ly justi­fied, but at least makes it clear that legi­ti­ma­te inte­rest can cer­tain­ly pro­vi­de a legal basis even in the con­text of asset deals.