[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fa5ZyijiAMfOsrycuTcuPJGeFb5ZCJ_YGqQfh7C_G1Wc":3},{"article":4,"iocs":44},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":28,"category":29,"article_tags":32},"d42a480f-9a92-45ed-ae4a-3f88f52113ce","Article 6 GDPR","article-6-gdpr-fd02c5","Flexible but legally uncertain ← Older revision Revision as of 09:34, 20 August 2026 Line 277: Line 277: [...] [...] That solution would make it possible for the members concerned, in accordance with the data minimisation principle referred to in paragraph 43 of the present judgment, to retain control over the disclosure of their personal data and thus to limit the disclosure of those data to what is in fact necessary and relevant in relation to the purposes for which those data are transmitted and processed [...]\".|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|51 et seq.}} That solution would make it possible for the members concerned, in accordance with the data minimisation principle referred to in paragraph 43 of the present judgment, to retain control over the disclosure of their personal data and thus to limit the disclosure of those data to what is in fact necessary and relevant in relation to the purposes for which those data are transmitted and processed [...]\".|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|51 et seq}} Despite the narrow interpretation of strict necessity, a controller is not prohibited from using personal data, just because there is a theoretical alternative that does not include the use of personal data, only realistic alternative must be considered. Processing that is \"useful\" but not objectively \"necessary\" is not covered and hence not allowed. Bucher, Petri, DS-GVO BDSG, Article 6 GDPR, margin numbers 15 (C.H. Beck 2024, 4th Edition); Kastelitz; Hötzendorfer; Tschohl, in Knyrim, DatKomm, Article 6 GDPR, margin numbers 19 (Manz 2020). For example [https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\u002Four-documents\u002Fguidelines\u002Fguidelines-22019-processing-personal-data-under-article-61b_en EDPB Guidelines 2\u002F2019 on Article 6(1)(b)] have clarified that assessing what is \"necessary\" involves a factual analysis of the processing operations and their purpose(s) and whether less intrusive alternatives that achieve the same goal exist. If there are realistic, less intrusive processing operations, then the other more intrusive ones must be excluded – i.e. they are not \"necessary\" under EU law. EDPB, ‘Guidelines 2\u002F2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, 8 October 2019’ (Version 2.0), p. 8 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Ffiles\u002Ffile1\u002Fedpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]). Despite the narrow interpretation of strict necessity, a controller is not prohibited from using personal data, just because there is a theoretical alternative that does not include the use of personal data, only realistic alternative must be considered. Processing that is \"useful\" but not objectively \"necessary\" is not covered and hence not allowed. Bucher, Petri, DS-GVO BDSG, Article 6 GDPR, margin numbers 15 (C.H. Beck 2024, 4th Edition); Kastelitz; Hötzendorfer; Tschohl, in Knyrim, DatKomm, Article 6 GDPR, margin numbers 19 (Manz 2020). For example [https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\u002Four-documents\u002Fguidelines\u002Fguidelines-22019-processing-personal-data-under-article-61b_en EDPB Guidelines 2\u002F2019 on Article 6(1)(b)] have clarified that assessing what is \"necessary\" involves a factual analysis of the processing operations and their purpose(s) and whether less intrusive alternatives that achieve the same goal exist. If there are realistic, less intrusive processing operations, then the other more intrusive ones must be excluded – i.e. they are not \"necessary\" under EU law. EDPB, ‘Guidelines 2\u002F2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, 8 October 2019’ (Version 2.0), p. 8 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Ffiles\u002Ffile1\u002Fedpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]). Line 479: Line 479: In accordance with the accountability principle under Article 5(2) GDPR, a controller invoking this legal basis is responsible for, and has to be able to demonstrate, compliance with each of those cumulative conditions. Therefore, the controller should document the performance of the legitimate interest assessment accordingly. Also, if a Data Protection Officer is appointed by the controller, they should be involved by the controller in this assessment. EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 45 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]). In accordance with the accountability principle under Article 5(2) GDPR, a controller invoking this legal basis is responsible for, and has to be able to demonstrate, compliance with each of those cumulative conditions. Therefore, the controller should document the performance of the legitimate interest assessment accordingly. Also, if a Data Protection Officer is appointed by the controller, they should be involved by the controller in this assessment. EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 45 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]). It should be pointed out that, according to the CJEU, a controller who wants to invoke the pursuit of a legitimate interest to allow the processing of personal data pursuant to Article 6(1)(f) GDPR, the controller has to comply with all its other obligations under the GDPR. CJEU, Case C-621\u002F22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 50 (available [https:\u002F\u002Fgdprhub.eu\u002FCJEU_-_C%E2%80%91621\u002F22_-_Koninklijke_Nederlandse_Lawn_Tennisbond here]) If a controller wants to rely on legitimate interest under Article 6(1)(f) GDPR for the processing of personal data for various purposes, the controller has to assess the validity of this legal basis for each of those purposes. EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 10 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]). If a controller wants to rely on legitimate interest under Article 6(1)(f) GDPR for the processing of personal data for various purposes, the controller has to assess the validity of this legal basis for each of those purposes. EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 10 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]). Line 507: Line 509: First , the interest hast so be lawful, i.e. the controller can legitimately pursue it and it is not contrary to EU or national law. However, it is not necessary that the interest is determined or enshrined in law. EDPB, '1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 17 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]); CJEU, Case C-621\u002F22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 40 (available [[CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|here]]). For example, the CJEU did not rule out that, in principle, also a commercial interest of the controller could be regarded as a legitimate interest. CJEU, Case C-621\u002F22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 48 (available [[CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|here]]). First , the interest hast so be lawful, i.e. the controller can legitimately pursue it and it is not contrary to EU or national law. However, it is not necessary that the interest is determined or enshrined in law. EDPB, '1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 17 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]); CJEU, Case C-621\u002F22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 40 (available [[CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|here]]). For example, the CJEU did not rule out that, in principle, also a commercial interest of the controller could be regarded as a legitimate interest. CJEU, Case C-621\u002F22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 48 (available [[CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|here]]). {{Quote-CJEU|\"As regards, first, the condition relating to the pursuit of a ‘legitimate interest’, it should be emphasised that, in the absence of a definition of that concept in the GDPR, as the Court has previously held, a wide range of interests is, in principle, capable of being regarded as legitimate [...]\".|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|38.}} {{Quote-CJEU|\"As regards, first, the condition relating to the pursuit of a ‘legitimate interest’, it should be emphasised that, in the absence of a definition of that concept in the GDPR, as the Court has previously held, a wide range of interests is, in principle, capable of being regarded as legitimate [...]\".|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|38}} As to what “law” means in this case, in the absence of updated guidance, reference should be made to the instructions provided by the WP29 in Opinion 3\u002F2013 on purpose limitation, according to which the notion of \"law\" must be interpreted in an extensive manner, including all forms of written or common law, as interpreted by the competent courts and supplemented by other official sources. WP29, ‘Opinion 06\u002F2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95\u002F46\u002FEC’ 844\u002F14\u002FEN WP 217, 9 April 2014, p. 25 (available [https:\u002F\u002Fec.europa.eu\u002Fjustice\u002Farticle-29\u002Fdocumentation\u002Fopinion-recommendation\u002Ffiles\u002F2014\u002Fwp217_en.pdf here]). The above seems to be confirmed by the recent guidelines on contract-based treatment. There, the EDPB clarified that the contract (and thus, by analogy, the legitimate interest) must be valid i.e. “''must comply with the requirements of contract laws and, as the case may be for consumer contracts, consumer protection laws in order for processing based on those terms to be considered fair and lawful''”. EDPB, ‘Guidelines 2\u002F2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects’, 8 October 2019 (Version 2.0), p. 5 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Ffiles\u002Ffile1\u002Fedpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]). Also, reference can be made to the Cookie Banner Taskforce, deeming the usage of legitimate interest for activities such as “create a personalised content profile” unlawful. The taskforce agreed that such processing requires consent according to Article 5(4) ePrivacy Directive. EDPB, ‘Report of the work undertaken by the Cookie Banner Taskforce’ 844\u002F14\u002FEN WP 217, 17 January 2023, p. 7 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsystem\u002Ffiles\u002F2023-01\u002Fedpb_20230118_report_cookie_banner_taskforce_en.pdf here]). As to what “law” means in this case, in the absence of updated guidance, reference should be made to the instructions provided by the WP29 in Opinion 3\u002F2013 on purpose limitation, according to which the notion of \"law\" must be interpreted in an extensive manner, including all forms of written or common law, as interpreted by the competent courts and supplemented by other official sources. WP29, ‘Opinion 06\u002F2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95\u002F46\u002FEC’ 844\u002F14\u002FEN WP 217, 9 April 2014, p. 25 (available [https:\u002F\u002Fec.europa.eu\u002Fjustice\u002Farticle-29\u002Fdocumentation\u002Fopinion-recommendation\u002Ffiles\u002F2014\u002Fwp217_en.pdf here]). The above seems to be confirmed by the recent guidelines on contract-based treatment. There, the EDPB clarified that the contract (and thus, by analogy, the legitimate interest) must be valid i.e. “''must comply with the requirements of contract laws and, as the case may be for consumer contracts, consumer protection laws in order for processing based on those terms to be considered fair and lawful''”. EDPB, ‘Guidelines 2\u002F2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects’, 8 October 2019 (Version 2.0), p. 5 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Ffiles\u002Ffile1\u002Fedpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]). Also, reference can be made to the Cookie Banner Taskforce, deeming the usage of legitimate interest for activities such as “create a personalised content profile” unlawful. The taskforce agreed that such processing requires consent according to Article 5(4) ePrivacy Directive. EDPB, ‘Report of the work undertaken by the Cookie Banner Taskforce’ 844\u002F14\u002FEN WP 217, 17 January 2023, p. 7 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsystem\u002Ffiles\u002F2023-01\u002Fedpb_20230118_report_cookie_banner_taskforce_en.pdf here]). Line 535: Line 537: =====Necessary for the purposes (2nd step in the assessment)===== =====Necessary for the purposes (2nd step in the assessment)===== Necessity is a condition for all legal bases but consent. Therefore, see the paragraph on ''necessity'' in general above. Necessity is a condition for all legal bases but consent. Therefore, see the paragraph on ''necessity'' in general above. {{Quote-CJEU|\"Second, with regard to the condition that the processing of personal data be necessary for the purposes of the legitimate interests pursued, that condition requires the referring court to ascertain that the legitimate data processing interests pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights and freedoms of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter [...]\"|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|42.}} {{Quote-CJEU|\"Second, with regard to the condition that the processing of personal data be necessary for the purposes of the legitimate interests pursued, that condition requires the referring court to ascertain that the legitimate data processing interests pursued cannot reasonably be achieved just as effectively by other means less restrictive of the fundamental rights and freedoms of data subjects, in particular the rights to respect for private life and to the protection of personal data guaranteed by Articles 7 and 8 of the Charter [...]\"|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|42}} =====Balancing Test (3rd step in the assessment)===== =====Balancing Test (3rd step in the assessment)===== Line 568: Line 570: ======Reasonable expectations of the data subject====== ======Reasonable expectations of the data subject====== Recital 47 GDPR stipulates that the reasonable expectations of the data subjects should be considered. In particular, it is important to evaluate whether the status of the data controller, the nature of the relationship or the service provided, or the applicable legal or contractual obligations (or other promises made at the time of collection) could give rise to reasonable expectations of stricter confidentiality and stricter limitations on further use. WP29, ‘Opinion 06\u002F2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95\u002F46\u002FEC’ 844\u002F14\u002FEN WP 217, 9 April 2014, p. 40 (available [https:\u002F\u002Fec.europa.eu\u002Fjustice\u002Farticle-29\u002Fdocumentation\u002Fopinion-recommendation\u002Ffiles\u002F2014\u002Fwp217_en.pdf here]). {{Quote-CJEU|\"[...] as regards the balancing of interests which it is for the referring court to carry out in the light of the specific circumstances of the dispute in the main proceedings, that court must take account, in particular, of the reasonable expectations of the data subject as well as the scale of the processing at issue and its impact on that person [...]\"|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|54.}}It is important to note that the reasonable expectations of a data subject could very well deviate from whatever is considered ''common practice'' or ''business standard'' in a certain sector. Also the fact that a processing activity is very established or has been taken place for a long time is not decisive for the question whether a processing is in the data subjects' reasonable expectations. Neither do the reasonable expectation of the data subject depend on the information provided by the data subject (e.g. in a privacy policy). compare EDPB, '1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 52 et seq. (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]). Recital 47 GDPR stipulates that the reasonable expectations of the data subjects should be considered. In particular, it is important to evaluate whether the status of the data controller, the nature of the relationship or the service provided, or the applicable legal or contractual obligations (or other promises made at the time of collection) could give rise to reasonable expectations of stricter confidentiality and stricter limitations on further use. WP29, ‘Opinion 06\u002F2014 on the notion of legitimate interests of the data controller under Article 7 of Directive 95\u002F46\u002FEC’ 844\u002F14\u002FEN WP 217, 9 April 2014, p. 40 (available [https:\u002F\u002Fec.europa.eu\u002Fjustice\u002Farticle-29\u002Fdocumentation\u002Fopinion-recommendation\u002Ffiles\u002F2014\u002Fwp217_en.pdf here]). {{Quote-CJEU|\"[...] as regards the balancing of interests which it is for the referring court to carry out in the light of the specific circumstances of the dispute in the main proceedings, that court must take account, in particular, of the reasonable expectations of the data subject as well as the scale of the processing at issue and its impact on that person [...]\"|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|54}}It is important to note that the reasonable expectations of a data subject could very well deviate from whatever is considered ''common practice'' or ''business standard'' in a certain sector. Also the fact that a processing activity is very established or has been taken place for a long time is not decisive for the question whether a processing is in the data subjects' reasonable expectations. Neither do the reasonable expectation of the data subject depend on the information provided by the data subject (e.g. in a privacy policy). compare EDPB, '1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 52 et seq. (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]). {{Quote-EDPB|\"While a failure to provide information can contribute to the data subjects being surprised, the mere fulfilment of information duties according to Articles 12, 13 and 14 GDPR is not sufficient in itself to consider that the data subjects can reasonably expect a given processing.\"|EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 68.|4=https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf}} {{Quote-EDPB|\"While a failure to provide information can contribute to the data subjects being surprised, the mere fulfilment of information duties according to Articles 12, 13 and 14 GDPR is not sufficient in itself to consider that the data subjects can reasonably expect a given processing.\"|EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 68.|4=https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf}} Line 650: Line 652: […] […] In that regard, it should be noted that […] it cannot be ruled out that ‘Member State law to which the controller is subject’ within the meaning of point (b) of Article 6(3) of the GDPR also covers national case-law.\"|CJEU - Joined Cases C‑17\u002F22 and C‑18\u002F22 - HTB Neunte Immobilien Portfolio|68 and 71.}} In that regard, it should be noted that […] it cannot be ruled out that ‘Member State law to which the controller is subject’ within the meaning of point (b) of Article 6(3) of the GDPR also covers national case-law.\"|CJEU - Joined Cases C‑17\u002F22 and C‑18\u002F22 - HTB Neunte Immobilien Portfolio|68 and 71}} Requirements under non-EU\u002FEEA laws, such as a US, Chinese or Swiss law requiring the processing of personal data, cannot be the basis for processing under Article 6(1)(c) or (e) GDPR. However, a duty under the law of another country may be a \"''legitimate interest''\" under Article 6(1)(f) GDPR, which can be the starting point of a balancing test. Requirements under non-EU\u002FEEA laws, such as a US, Chinese or Swiss law requiring the processing of personal data, cannot be the basis for processing under Article 6(1)(c) or (e) GDPR. However, a duty under the law of another country may be a \"''legitimate interest''\" under Article 6(1)(f) GDPR, which can be the starting point of a balancing test.","This article details the interpretation and application of Article 6 of the GDPR, focusing on the legal bases for processing personal data. It highlights the strict interpretation of 'necessity,' emphasizing that only realistic alternatives to data processing should be considered, and 'useful' but not objectively 'necessary' processing is disallowed. The text also delves into the 'legitimate interest' basis, stressing the controller's responsibility to demonstrate compliance and the importance of considering data subjects' reasonable expectations, which may differ from common industry practices.","Article 6 GDPR clarifies data processing legality, emphasizing necessity and reasonable expectations.","Help Article 6 GDPR: Difference between revisions From GDPRhub Jump to:navigation, search ← Older editVisualWikitext Revision as of 07:31, 17 July 2026 view sourceAv (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators140 edits Tag: Visual edit← Older edit Latest revision as of 09:34, 20 August 2026 view source Mba (talk | contribs)Bureaucrats, Interface administrators, noContributionReport, Administrators969 editsm Tag: Visual edit Line 277: Line 277: [...][...] That solution would make it possible for the members concerned, in accordance with the data minimisation principle referred to in paragraph 43 of the present judgment, to retain control over the disclosure of their personal data and thus to limit the disclosure of those data to what is in fact necessary and relevant in relation to the purposes for which those data are transmitted and processed [...]\".|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|51 et seq.}}That solution would make it possible for the members concerned, in accordance with the data minimisation principle referred to in paragraph 43 of the present judgment, to retain control over the disclosure of their personal data and thus to limit the disclosure of those data to what is in fact necessary and relevant in relation to the purposes for which those data are transmitted and processed [...]\".|CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|51 et seq}} Despite the narrow interpretation of strict necessity, a controller is not prohibited from using personal data, just because there is a theoretical alternative that does not include the use of personal data, only realistic alternative must be considered. Processing that is \"useful\" but not objectively \"necessary\" is not covered and hence not allowed.\u003Cref>Bucher, Petri, DS-GVO BDSG, Article 6 GDPR, margin numbers 15 (C.H. Beck 2024, 4th Edition); Kastelitz; Hötzendorfer; Tschohl, in Knyrim, DatKomm, Article 6 GDPR, margin numbers 19 (Manz 2020).\u003C\u002Fref>\u003C\u002Fblockquote>For example [https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\u002Four-documents\u002Fguidelines\u002Fguidelines-22019-processing-personal-data-under-article-61b_en EDPB Guidelines 2\u002F2019 on Article 6(1)(b)] have clarified that assessing what is \"necessary\" involves a factual analysis of the processing operations and their purpose(s) and whether less intrusive alternatives that achieve the same goal exist. If there are realistic, less intrusive processing operations, then the other more intrusive ones must be excluded – i.e. they are not \"necessary\" under EU law.\u003Cref>EDPB, ‘Guidelines 2\u002F2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, 8 October 2019’ (Version 2.0), p. 8 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Ffiles\u002Ffile1\u002Fedpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]).\u003C\u002Fref> Despite the narrow interpretation of strict necessity, a controller is not prohibited from using personal data, just because there is a theoretical alternative that does not include the use of personal data, only realistic alternative must be considered. Processing that is \"useful\" but not objectively \"necessary\" is not covered and hence not allowed.\u003Cref>Bucher, Petri, DS-GVO BDSG, Article 6 GDPR, margin numbers 15 (C.H. Beck 2024, 4th Edition); Kastelitz; Hötzendorfer; Tschohl, in Knyrim, DatKomm, Article 6 GDPR, margin numbers 19 (Manz 2020).\u003C\u002Fref>\u003C\u002Fblockquote>For example [https:\u002F\u002Fedpb.europa.eu\u002Four-work-tools\u002Four-documents\u002Fguidelines\u002Fguidelines-22019-processing-personal-data-under-article-61b_en EDPB Guidelines 2\u002F2019 on Article 6(1)(b)] have clarified that assessing what is \"necessary\" involves a factual analysis of the processing operations and their purpose(s) and whether less intrusive alternatives that achieve the same goal exist. If there are realistic, less intrusive processing operations, then the other more intrusive ones must be excluded – i.e. they are not \"necessary\" under EU law.\u003Cref>EDPB, ‘Guidelines 2\u002F2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects, 8 October 2019’ (Version 2.0), p. 8 (available [https:\u002F\u002Fedpb.europa.eu\u002Fsites\u002Fdefault\u002Ffiles\u002Ffiles\u002Ffile1\u002Fedpb_guidelines-art_6-1-b-adopted_after_public_consultation_en.pdf here]).\u003C\u002Fref> Line 479: Line 479: In accordance with the accountability principle under Article 5(2) GDPR, a controller invoking this legal basis is responsible for, and has to be able to demonstrate, compliance with each of those cumulative conditions. Therefore, the controller should document the performance of the legitimate interest assessment accordingly. Also, if a Data Protection Officer is appointed by the controller, they should be involved by the controller in this assessment.\u003Cref>EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 45 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]).\u003C\u002Fref>In accordance with the accountability principle under Article 5(2) GDPR, a controller invoking this legal basis is responsible for, and has to be able to demonstrate, compliance with each of those cumulative conditions. Therefore, the controller should document the performance of the legitimate interest assessment accordingly. Also, if a Data Protection Officer is appointed by the controller, they should be involved by the controller in this assessment.\u003Cref>EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 45 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]).\u003C\u002Fref> It should be pointed out that, according to the CJEU, a controller who wants to invoke the pursuit of a legitimate interest to allow the processing of personal data pursuant to Article 6(1)(f) GDPR, the controller has to comply with all its other obligations under the GDPR.\u003Cref>CJEU, Case C-621\u002F22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 50 (available [https:\u002F\u002Fgdprhub.eu\u002FCJEU_-_C%E2%80%91621\u002F22_-_Koninklijke_Nederlandse_Lawn_Tennisbond here])\u003C\u002Fref> If a controller wants to rely on legitimate interest under Article 6(1)(f) GDPR for the processing of personal data for various purposes, the controller has to assess the validity of this legal basis for each of those purposes.\u003Cref>EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 10 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]).\u003C\u002Fref>If a controller wants to rely on legitimate interest under Article 6(1)(f) GDPR for the processing of personal data for various purposes, the controller has to assess the validity of this legal basis for each of those purposes.\u003Cref>EDPB, 'Guidelines 1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 10 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]).\u003C\u002Fref> Line 507: Line 509: \u003Cu>First\u003C\u002Fu>, the interest hast so be lawful, i.e. the controller can legitimately pursue it and it is not contrary to EU or national law. However, it is not necessary that the interest is determined or enshrined in law.\u003Cref>EDPB, '1\u002F2024 on processing of personal data based on Article 6(1)(f) GDPR', 8 October 2024 (Version 1), margin number 17 (available [https:\u002F\u002Fwww.edpb.europa.eu\u002Fsystem\u002Ffiles\u002F2024-10\u002Fedpb_guidelines_202401_legitimateinterest_en.pdf here]); CJEU, Case C-621\u002F22, ''Koninklijke Nederlandse Lawn Tennisbond,'' 4 October 2024, margin number 40 (available [[CJEU - C‑621\u002F22 - Koninklijke Nederlandse Lawn Tennisbond|here]]).\u003C\u002Fref> For example, the CJEU did not rule out th","https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=Article_6_GDPR&diff=52739&oldid=52304",null,"2026-08-20T09:34:08+00:00","2026-08-20T10:00:19.66809+00:00",7,[18,21,24,26],{"name":19,"type":20},"GDPR","product",{"name":22,"type":23},"EDPB","vendor",{"name":25,"type":23},"CJEU",{"name":27,"type":23},"WP29","c5c77cdb-f7d7-4990-9436-c81dcbff1163",{"id":28,"icon":13,"name":30,"slug":31},"Policy","policy",[33,37,42],{"category":34},{"id":35,"icon":13,"name":19,"slug":36},"3f0f8451-91df-4b6c-9a73-ef3b2509b7f1","gdpr",{"category":38},{"id":39,"icon":13,"name":40,"slug":41},"53f9c4b6-8bc6-4964-9169-d09e5cd41d72","Compliance","compliance",{"category":43},{"id":28,"icon":13,"name":30,"slug":31},[]]