Guidance has been published on when personal data can be lawfully processed on grounds it is "necessary for the purpose of the legitimate interests" of the data controller or a third party to whom it is disclosed. The guidance is set out in an opinion published by the Article 29 Working Party, (the independent European advisory body on data protection).
The availability of this ground for lawful data processing will depend upon the balance between the legitimate interests of the data controller or third party receiving the data and the interests and fundamental rights of the data subject. The opinion gives some examples of how this balancing test should be applied and concludes that although the legitimate interests should not be seen as a ground that can only be used sparingly as a "last resort", neither should it be used as a preferred option because it is considered less constraining than other grounds. The Working Party also concluded that appropriate use of the ground may guard against misuse or over-reliance on other grounds for data processing, such as the ground of consent or necessity "for the performance of a contract".