The Legitimate Interest Balancing Test

Article 6 of the GDPR gives a controller six lawful bases for processing, and legitimate interest is the one the exam returns to most, because it is the only basis that asks you to make a judgement rather than tick a box. The CIPP/E Body of Knowledge, the blueprint the exam is built from, expects you to know when legitimate interest applies, how to test it and where it fails. Get the reasoning right and a whole class of questions opens up. Get it wrong and you will reach for consent when you never needed it.

Legitimate interest lives in Article 6(1)(f): processing is lawful where it is necessary for the interests pursued by the controller or a third party, unless those interests are overridden by the rights and freedoms of the data subject. Two limits sit inside that sentence. A public authority cannot use it for its own tasks, and a child on the other side of the balance weighs heavily.

The three-part test, in order

The framework comes from the Article 29 Working Party's Opinion 06/2014 and is carried forward by the EDPB. Three questions, in order:

• Purpose: is there a real, specific interest, lawful and clearly stated? "We might use it later" is not one.
• Necessity: is the processing actually needed for that interest, or is there a less intrusive route to the same end?
• Balancing: do the individual's interests, rights and freedoms override the interest you identified?

Fail the first two and the balance never runs. Pass them and the balance decides the outcome.

The balancing test, step by step

The balance is not guesswork. It weighs the controller's interest against the data subject's reasonable expectations, the nature of the data and the impact of the processing. Recital 47 is the anchor: the question is what the data subject would reasonably expect when their data was collected, given their relationship with the controller. Processing they would find surprising tilts the balance against you.

Direct marketing is the case the exam loves here. Recital 47 says direct marketing may be regarded as a legitimate interest. "May be" is doing the work. It is a starting position, not a licence, and it collapses the moment the person objects.

Two factors move the balance on their own. Children get extra protection under Recital 38, so a purpose that clears the balance for adults can fail where minors are involved. And the balance is not just a thought you had. Under the accountability principle you document your reasoning, the legitimate interests assessment or LIA, so a regulator can see what you relied on. A balance you cannot show is a balance you cannot defend.

The exam traps that sink candidates

Four traps recur. First, the public authority carve-out: legitimate interest is off the table for public authorities acting in their public tasks, so a stem featuring a regulator or a ministry is steering you to another basis.

Second, transparency. Articles 13 and 14 require you to name the legitimate interest at the point of collection. An interest you never disclosed is hard to rely on afterwards.

Third, the right to object. Under Article 21 a data subject can object to that processing on grounds relating to their situation, and you must stop unless you show compelling grounds that override. For direct marketing the right to object is absolute: once they say stop, you stop, with no balancing left to do.

Legitimate interest and special category data

The fourth trap is the sharpest. Legitimate interest is an Article 6 basis only. It does nothing for special category data, which needs a separate Article 9 condition on top. If a question puts health, biometric or trade-union data in front of you and offers legitimate interest as the answer, that answer is wrong on its face. You need both an Article 6 basis and an Article 9 condition, and it is not among the Article 9 conditions.

How to answer a legitimate interest question

Treat consent and legitimate interest as different tools, not interchangeable ones. Consent is given by the data subject and can be withdrawn; legitimate interest is assessed by you and can be objected to. You choose the basis at the outset and document why; you do not fall back from a failed consent to legitimate interest after the fact.

So when a stem hands you a processing activity, run the order. Is it a public authority doing its tasks? This basis is out. Is it special category data? Legitimate interest is not enough. Otherwise walk the three-part test, land the balance on reasonable expectations and check whether an objection has changed the picture. That sequence answers most legitimate interest questions on the paper.

If you want the test as a worksheet you can run against any scenario, work through the practice material at 22academy.com/study.