FEDMA’s Response to EDPB’s Guidelines on Legitimate Interest: Striking a Balance for Innovation and Privacy

Last week, the Federation of European Data and Marketing (FEDMA) submitted its feedback on the European Data Protection Board’s (EDPB) draft Guidelines 1/2024, which address the use of legitimate interest as a legal basis for processing personal data under Article 6(1)(f) of the GDPR. This legal basis is essential for enabling responsible data-driven marketing while respecting user privacy.

FEDMA emphasizes the need for a balanced approach that considers both privacy rights and the fundamental freedom to conduct business, as outlined in GDPR Recital 4. Legitimate interest, when applied responsibly, fosters innovation, supports economic growth, and enables effective, privacy-conscious marketing practices.

FEDMA’s Key Points & Recommendations

Avoiding Overgeneralization of Legitimate Interest: The guidelines reference the CJEU META Case, which assessed legitimate interest in the context of a global social media platform operating as a Very Large Online Platform (VLOP) under the Digital Services Act and a Gatekeeper under the Digital Markets Act. FEDMA warns that extending this interpretation to all digital advertising actors would unfairly burden smaller organizations that operate differently from VLOPs. A one-size-fits-all approach undermines fairness and risks stifling innovation.

Future-Proofing for Innovation: FEDMA highlights the importance of evolving the guidelines to remain relevant in an era of rapid technological advancements, especially in the context of AI training models and the use of publicly accessible sources. Reliance on GDPR’s legitimate interest should align with the objectives of the EU Data Strategy towards the development of a modern framework enabling fair, practical and clear access and use of data in line with privacy, data protection and competition laws.

Equal Treatment of GDPR Legal Bases: FEDMA emphasizes that all GDPR legal bases must be treated equally, without imposing additional requirements beyond what the regulation explicitly provides. The legitimate interest legal basis already includes robust safeguards, such as balancing tests and transparency obligations. Introducing new conditions risks creating legal uncertainty and unfairly favouring other legal bases like consent, which may not be practical in all scenarios. FEDMA urges the EDPB to respect GDPR’s framework, ensuring that legitimate interest remains a viable, proportionate option for responsible data processing.

Promotion of Privacy Enhancing Technologies: FEDMA highlights the critical role of GDPR-level Privacy Enhancing Technologies (PETs) like pseudonymization in minimizing risks while enabling data-driven innovation. Recognizing these tools as effective safeguards within the legitimate interest framework would encourage their adoption, enhancing privacy protections without stifling business growth. FEDMA urges the EDPB to explicitly acknowledge these measures in its guidelines.

Proportionality and Transparency: FEDMA calls on the EDPB to recognise the role of transparency, as provided by the GDPR, in shaping users’ reasonable expectations. The guidelines should ensure that businesses providing clear, accessible information about their data practices are not unfairly restricted from using legitimate interest.

Legitimate Interest in New Customer Acquisition: FEDMA underscores the importance of legitimate interest for new customer acquisition, particularly for businesses without an existing customer base. Restricting its use would hinder companies’ ability to grow, which is fundamental to the freedom to conduct business as outlined in GDPR Recital 4. FEDMA calls on the EDPB to clarify and support the use of legitimate interest for responsibly attracting and engaging potential customers, ensuring fairness and economic opportunity in the data-driven marketing ecosystem.

By adopting a future-proof and proportionate approach, the EDPB can ensure that businesses continue to innovate responsibly, delivering benefits to both the economy and individuals while upholding fundamental privacy rights.

Read FEDMA’s full response to the EDPB consultation here