Annex 2. Practical examples to illustrate the application of the Article 7(f) balancing test This Annex provides examples with regard to some of the most common contexts in which the issue of legitimate interest in the meaning of Article 7(f) may arise. In most cases, we grouped together two or more related examples that are worth comparing under a single heading. Many of the examples are based on actual cases, or elements of actual cases handled by data protection authorities in the different Member States. However, we have sometimes changed the facts to some degree to help better illustrate how to carry out the balancing test. The examples are included in order to illustrate the thinking process - the method to be used to carry out the multi-factor balancing test. In other words, the examples are not meant to provide a conclusive assessment of the cases described. Indeed, in many cases, by changing the facts of the case in some way (for example, if the controller were to adopt additional safeguards such as more complete anonymisation, better security measures, and more transparency and more genuine choice for the data subjects), the outcome of the balancing test could change.116 This should encourage controllers to better comply with all horizontal provisions of the Directive and offer additional protection where relevant based on privacy and data protection by design. The greater care controllers take to protect personal data overall, the more likely it is that they will satisfy the balancing test. Exercise of the right to freedom of expression or information117, including in the media and the arts Example 1: NGO republishes expenses of Members of Parliament A public authority publishes - under a legal obligation (Article 7(c)) - expenses of members of parliament; a transparency NGO, in turn, analyses and re-publishes data in an accurate, proportionate, but more informative annotated version, contributing to further transparency and accountability. Assuming the NGO carries out the re-publication and annotation in an accurate and proportionate manner, adopts appropriate safeguards, and more broadly, respects the rights of the individuals concerned, it should be able to rely on Article 7(f) as a legal ground for the processing. Factors such as the nature of the legitimate interest (a fundamental right to freedom of expression or information), the interest of the public in transparency and accountability, and the fact that the data have already been published and concern (relatively
116
Applying correctly Article 7(f) may raise complex issues of assessment, and to help guide the assessment, specific legislation, case law, jurisprudence, guidelines, as well as codes of conduct and other formal or less formal standards may all play an important role. 117 On freedom of expression or information, see page 34 of the Opinion. Any relevant derogations under national law for processing for journalistic purposes under Article 9 of the Directive must also be taken into account when assessing these examples.
57
