The German Conference of Independent Federal and State Data Protection Authorities (DSK) has addressed the question under which circumstances data processing in asset deals is in a legitimate interest within the meaning of Art. 6(1)(f). It has defined a number of case groups for this purposein which, in its opinion, there is a legitimate interest (which is not opposed by overriding conflicting interests of the data subjects):
- Customer data for current contracts, if the customer approves the transfer of the contract;
- Existing customers without current contracts and last contractual relationship older than 3 years: here the acquirer should be allowed to use the data for archiving purposes only;
- potential customers with “advanced contract initiation” and existing customers without current contracts and last contractual relationship younger than 3 years: in this case, the acquirer should inform the customers of the transfer and grant them a “generous” objection period; if there is no objection, the acquirer may use the data (excluding bank data) productively;
- Customer data at outstanding receivables: Receivables may be transmitted;
- Special categories of personal data: The transfer is only permitted with consent.
The position of the DSK – which the authorities of Saxony and Berlin have not followed – is hardly justified, but at least makes it clear that legitimate interest can certainly provide a legal basis even in the context of asset deals.