II.2. Role of concept

Regulation itself. A list of cases was drafted in which the legitimate interests of the data controller as a rule would override the legitimate interests and fundamental rights and freedoms of the data subject, and a second list of cases in which this would be the other way around. These lists - laid down either in provisions or in recitals - provide relevant input to the assessment of the balance between the rights and interests of the controller and the data subject, and are taken into account in this Opinion. 19

II.2. Role of concept

Legitimate interests of the controller: balancing test as a final option?

Article 7(f) is listed as the last option among six grounds allowing for the lawful processing of personal data. It calls for a balancing test: what is necessary for the legitimate interests of the controller (or third parties) must be balanced against the interests or fundamental rights and freedoms of the data subject. The outcome of the balancing test determines whether Article 7(f) may be relied upon as a legal ground for processing.

The open-ended nature of this provision raises many important questions regarding its exact scope and application, which will be analysed in turn in this Opinion. However, as will be explained below, it does not necessarily mean that this option should be seen as one that can only be used sparingly to fill in gaps for rare and unforeseen situations as ‘a last resort’, or as a last chance if no other grounds apply. Nor should it be seen as a preferred option and its use unduly extended because it would be considered as less constraining than the other grounds.

Instead, it may well be that Article 7(f) has its own natural field of relevance and that it can play a very useful role as a ground for lawful processing, provided that a number of key conditions are fulfilled.

Appropriate use of Article 7(f), in the right circumstances and subject to adequate safeguards, may also help prevent misuse of, and over-reliance on, other legal grounds.

The first five grounds of Article 7 rely on the data subject’s consent, contractual arrangement, legal obligation or other specifically identified rationale as ground for legitimacy. When processing is based on one of these five grounds, it is considered as a priori legitimate and therefore only subject to compliance with other applicable provisions of the law. There is in other words a presumption that the balance between the different rights and interests at stake – including those of the controller and the data subject - is satisfied - assuming, of course, that all other provisions of data protection law are complied with. Article 7(f) on the other hand requires a specific test, for cases that do not fit in the scenarios pre-defined under grounds (a) to (e). It ensures that, outside these scenarios, any processing has to meet the requirement of a balancing test, taking duly into account the interests and fundamental rights of the data subject.

This test may lead to the conclusion in certain cases that the balance weighs in favour of the interests and fundamental rights of the data subjects, and that consequently the processing

See, in particular, amendments 101 and 102. See also the amendments adopted by the Committee on 21.10.2013 in their final report ('Final LIBE Committee Report'). 19 See Section III.3.1, in particular, the bullet-points on pages 24-25 containing a non-exhaustive list of some of the most common contexts in which the issue of legitimate interest under Article 7(f) may arise.