- the status of the data controller and data subject, including the balance of power between the data subject and the data controller, or whether the data subject is a child or otherwise belongs to a more vulnerable segment of the population.
additional safeguards to prevent undue impact on the data subjects, including: - data minimisation (e.g. strict limitations on the collection of data, or immediate deletion of data after use); - technical and organisational measures to ensure that the data cannot be used to take decisions or other actions with respect to individuals ('functional separation'); - extensive use of anonymisation techniques, aggregation of data, privacy-enhancing technologies, privacy by design, privacy and data protection impact assessments; - increased transparency, general and unconditional right to opt-out, data portability & related measures to empower data subjects.
Accountability, transparency, the right to object and beyond In connection with these safeguards - and the overall assessment of the balance - three issues often play a crucial role in the context of Article 7(f) and therefore require special attention: -
the existence of some and possible need for additional measures to increase transparency and accountability; the right of the data subject to object to the processing, and beyond objection, the availability of opt-out without the need for any justification; empowering data subjects: data portability and the availability of workable mechanisms for the data subject to access, modify, delete, transfer, or otherwise further process (or let third parties further process) their own data.
IV. 2. Recommendations The current text of Article 7(f) of the Directive is open-ended. This flexible wording leaves much room for interpretation and has sometimes - as experience has shown - led to lack of predictability and lack of legal certainty. However, if used in the right context, and with the application of the right criteria, as set out in this Opinion, Article 7(f) has an essential role to play as a legal ground for legitimate data processing. The Working Party therefore supports the current approach in Article 6 of the proposed Regulation, which maintains the balance of interests as a separate legal ground. Further guidance would however be welcome to ensure an adequate application of the balancing test. Scope and means for further specification An essential requirement would be that the provision remains sufficiently flexible, and that it reflects both the perspectives of the data controller and the data subject, and the dynamic nature of the relevant contexts. For this reason, the Working Party is of the view that providing - in the text of the proposed Regulation or in delegated acts - for detailed and exhaustive lists of situations in which an interest would be qualified de facto as legitimate is not advisable, The Working Party would equally be against defining cases where the interest or right of one party should as a principle or as a presumption override the interest or right of
51
