II.3. Related concepts

activity cannot take place. On the other hand, an appropriate assessment of the balance under Article 7(f), often with an opportunity to opt-out of the processing, may in other cases be a valid alternative to inappropriate use of, for instance, the ground of 'consent' or ‘necessity for the performance of a contract'. Considered in this way, Article 7(f) presents complementary safeguards - which require appropriate measures - compared to the other pre-determined grounds. It should thus not be considered as 'the weakest link' or an open door to legitimise all data processing activities which do not fall under any of the other legal grounds.

The Working Party reiterates that when interpreting the scope of Article 7(f), it aims at a balanced approach, which ensures the necessary flexibility for data controllers for situations where there is no undue impact on data subjects, while at the same time providing sufficient legal certainty and guarantees to data subjects that this open-ended provision will not be misused.

II.3. Related concepts

Relationship of Article 7(f) with other grounds for lawfulness

Article 7 starts with consent, and goes on to list the other grounds for lawfulness, including contracts and legal obligations, moving gradually to the legitimate interest test, which is listed as the last among the six available grounds. The order in which the legal grounds are listed under Article 7 has sometimes been interpreted as an indication of the respective importance of the different grounds. However, as already emphasised in the Working Party's Opinion on the notion of consent20 , the text of the Directive does not make a legal distinction between the six grounds and does not suggest that there is a hierarchy among them. There is not any indication that Article 7(f) should only be applied in exceptional cases and the text also does not otherwise suggest that the specific order of the six legal grounds would have any legally relevant effect. At the same time, the precise meaning of Article 7(f) and its relation with other grounds for lawfulness have long been rather unclear.

Against this background and considering the historical and cultural diversities and the openended language of the Directive, different approaches have developed: some Member States have tended to see Article 7(f) as a least preferred ground, which is meant to fill the gaps only in a few exceptional cases when none of the five other grounds could or would apply.21 Other Member States, in contrast, see it only as one of six options, and one which is no more or no less important than the other options, and which may apply in a large number and large variety of situations, provided the necessary conditions are met.

Considering these diversities, and also in light of the ASNEF and FECEMD judgment, it is important to clarify the relationship of the ‘legitimate interests’ ground with the other grounds of lawfulness - e.g. in relation to consent, contracts, tasks of public interest - and also in relation to the right of the data subject to object. This may help better define the role and function of the legitimate interests ground and thus may contribute to legal certainty.

20 See footnote 2 above. 21 It should also be noted that the Draft LIBE Committee Report, in its Amendment 100 proposed to separate Article 7(f) from the rest of the legal grounds and also proposed additional requirements for the case when this legal ground is relied on, including more transparency and stronger accountability, as will be shown later.

It should also be noted that the legitimate interests ground, along with the other grounds apart from consent, requires a 'necessity' test. This strictly limits the context in which they each can apply. The European Court of Justice considered that ‘necessity’ is a concept which has its own independent meaning in Community law.22 The European Court of Human Rights also provided helpful guidance.23

Moreover, having an appropriate legal ground does not relieve the data controller of its obligations under Article 6 with regard to fairness, lawfulness, necessity and proportionality, as well as data quality. For instance, even if the processing of personal data is based on the legitimate interests ground, or on the performance of a contract, this would not allow for the collection of data which is excessive in relation to the purpose specified.

Legitimate interests and other grounds of Article 7 are alternative grounds and thus, it is sufficient if only one of them applies. However, they come as cumulative not only with the requirements of Article 6, but also with all other data protection principles and requirements that may be applicable.

Other balancing tests

Article 7(f) is not the only balancing test foreseen in the Directive. For example, Article 9 calls for balancing the right to the protection of personal data and freedom of expression. This Article allows Member States to provide the necessary exemptions and derogations for the processing of personal data 'carried out solely for journalistic purposes or the purpose of artistic or literary expression' if these are 'necessary to reconcile the right to privacy with the rules governing freedom of expression'.

In addition, many other provisions of the Directive also require case-by-case analysis, balancing of interests and rights at stake, and a flexible multi-factor assessment. These include the provisions on necessity, proportionality, and purpose limitation, Article 13 exceptions, and scientific research, just to name a few.

Indeed, it appears that the Directive was designed to leave room for interpretation and balancing of interests. This was, of course, at least in part meant to leave further room for Member States for implementation into national law. However, in addition to this, the need for some flexibility also comes from the very nature of the right to the protection of personal data and the right to privacy. Indeed, these two rights, along with most (but not all) other fundamental rights, are considered relative, or qualified, human rights. 24 These types of rights

22 Judgment of the European Court of Justice of 16 December 2008 in case C-524/06 (Heinz Huber v Bundesrepublik Deutschland), para 52: 'Consequently, having regard to the objective of ensuring an equivalent level of protection in all Member States, the concept of necessity laid down by Article 7(e) of Directive 95/46, the purpose of which is to delimit precisely one of the situations in which the processing of personal data is lawful, cannot have a meaning which varies between the Member States. It therefore follows that what is at issue is a concept which has its own independent meaning in Community law and which must be interpreted in a manner which fully reflects the objective of that directive, as laid down in Article 1(1) thereof.' 23 Judgment of the European Court of Human Rights in case Silver & Others v United Kingdom of 25 March 1983, para 97 discussing the term 'necessary in a democratic society': 'the adjective "necessary" is not synonymous with "indispensable", neither has it the flexibility of such expressions as "admissible", "ordinary", "useful", "reasonable" or "desirable" ….' 24 There are only a few human rights that cannot be balanced against the rights of others, or the interests of the wider community. These are known as absolute rights. These rights can never be limited or restricted, whatever