Harper James advises businesses on using legitimate interests as a lawful basis for processing personal data under the UK GDPR. A Legitimate Interest Assessment (LIA) records why the processing is necessary, how it affects individuals and what safeguards the organisation has applied.
An LIA should address three questions. First, identify the legitimate interest. This can include fraud prevention, network security, managing a customer relationship, internal administration or direct marketing in appropriate circumstances. The interest must be specific and lawful, rather than a general business objective.
Second, assess necessity. Consider whether the proposed processing is genuinely required to achieve that purpose and whether a less intrusive method is reasonably available. Processing that is excessive, unrelated or based on inaccurate data will not satisfy this part of the assessment.
Third, complete a balancing test. Compare the organisation’s interest with the individual’s interests, rights and freedoms. Relevant factors include the nature of the data, the person’s reasonable expectations, the relationship with the organisation, the potential impact of the processing, the scale of the activity and any safeguards, such as data minimisation, access controls, retention limits and an easy opt-out.
The LIA should identify the controller, processing activity, data subjects, data types, purpose, recipients, retention period and safeguards. It should explain the reasoning for each part of the test and record who approved the assessment. The organisation must also provide the required privacy information and tell individuals when it relies on legitimate interests, including the specific interest pursued.
Legitimate interests do not override an individual’s absolute rights or remove other legal requirements. Special category data requires an additional Article 9 condition. Electronic direct marketing is also subject to the Privacy and Electronic Communications Regulations (PECR), so a legitimate interest assessment alone does not establish permission to send marketing messages. Assessments should be reviewed when the purpose, technology, data, risk or relationship with individuals changes, and when an objection or complaint raises a material issue.