Article 7(f) to fundamental rights 'which require protection under Article 1(1)' - and thus the explicit reference to the object of the Directive64 - would not also apply to the term 'interests'. The clear message is nevertheless that all relevant interests of the data subject should be taken into account. This interpretation of the text makes sense not only grammatically, but also when taking into account the broad interpretation of the notion of the 'legitimate interests' of the controller. If the controller - or the third party in the case of disclosure - can pursue any interests, provided they are not illegitimate, then the data subject should also be entitled to have all categories of interests to be taken into account and weighed against those of the controller, as long as they are relevant within the scope of the Directive. At a time of increasing imbalance in 'informational power', when governments and business organisations alike amass hitherto unprecedented amounts of data about individuals, and are increasingly in the position to compile detailed profiles that will predict their behaviour (reinforcing informational imbalance and reducing their autonomy), it is ever more important to ensure that the interests of the individuals to preserve their privacy and autonomy be protected. Finally, it is important to note that unlike the case of the controller’s interests, the adjective ‘legitimate’ is not used here to precede the ‘interests’ of the data subjects. This implies a wider scope to the protection of individuals’ interests and rights. Even individuals engaged in illegal activities should not be subject to disproportionate interference with their rights and interests65. For example, an individual who may have perpetrated theft in a supermarket could still see his interests prevailing against the publication of his picture and private address on the walls of the supermarket and/or on the Internet by the owner of the shop. III.3.3. Introduction to applying the balancing test It is useful to imagine both the legitimate interests of the controller and the impact on the interests and rights of the data subject on a spectrum. Legitimate interests can range from insignificant through somewhat important to compelling. Similarly, the impact on the interests and rights of the data subjects may be more or may be less significant and may range from trivial to very serious. Legitimate interests of the controller, when minor and not very compelling may, in general, only override the interests and rights of data subjects in cases where the impact on these rights and interests are even more trivial. On the other hand, important and compelling legitimate interests may in some cases and subject to safeguards and measures justify even significant intrusion into privacy or other significant impact on the interests or rights of the data subjects66. 64
See Article 1(1): 'In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data'. 65 Of course, one of the consequences of criminality might be the collection and possible publication of personal data about criminals and suspects. This, however, must be subject to strict conditions and safeguards. 66 See as an illustration the reasoning of the Working Party in several opinions and working documents: - Opinion 4/2006 on the Notice of proposed rule-making by the US Department of Health and Human Services on the control of communicable disease and the collection of passenger information of 20 November 2005
30
