Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our websites and allows us to improve our sites. As stated in the banner shown when you first visit, by continuing to browse the site, you are agreeing to our use of cookies on that site.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer. By using the web-site you are agreeing to using cookies. Cookies contain information that is transferred to your computer’s hard drive. Our sites may use one or more of the following sorts of cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our websites. They include, for example, cookies that enable you to log into secure areas.
• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around a website when they are using it. This helps us to improve the way our websites work, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies. These are used to recognise you when you return to a website. This enables us to personalise our content for you and remember your preferences.
• Targeting cookies. These cookies record your visit to our websites, the pages you have visited and the links you have followed. We will use this information to make our websites and the advertising displayed on it more relevant to your interests.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

Examples of third party cookies providing external services include

• Google Analytics
• Twitter
• Facebook
• Pinterest
• LinkedIn
• Instagram
• Google+

Further information about them may be obtained from their respective websites.

If you wish to find out more about cookies, you may like to visit http://www.aboutcookies.org/ which is an independent third party resource that explains what cookies and clear gifs are and how you may manage them. Please note that we are not responsible for and have no control over the content of this third party website.

You may block cookies by activating the setting on your browser that allows you to disable the use of them. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our websites.

Except for strictly necessary and functional cookies, cookies will expire after within two years.

At a Glance

• Legitimate interests is the most flexible lawful basis for processing, but you cannot assume it will always be the most appropriate.
• It is likely to be most appropriate where you use people’s data in ways they would reasonably expect and which have a minimal privacy impact, or where there is a compelling justification for the processing.
• If you choose to rely on legitimate interests, you are taking on extra responsibility for considering and protecting people’s rights and interests.
• Public authorities can only rely on legitimate interests if they are processing for a legitimate reason other than performing their tasks as a public authority.
• There are three elements to the legitimate interests basis. It helps to think of this as a three-part test. You need to:

1. Identify a legitimate interest;
2. Show that the processing is necessary to achieve it; and
3. balance it against the individual’s interests, rights and freedoms.

• The legitimate interests can be your own interests or the interests of third parties. They can include commercial interests, individual interests or broader societal benefits.
• The processing must be necessary. If you can reasonably achieve the same result in another less intrusive way, legitimate interests will not apply.
• You must balance your interests against the individual’s. If they would not reasonably expect the processing, or if it would cause unjustified harm, their interests are likely to override your legitimate interests.
• Keep a record of your legitimate interests assessment (LIA) to help you demonstrate compliance if required.
• You must include details of your legitimate interests in your privacy notice.

Checklists

• We have checked that legitimate interests is the most appropriate basis.
• We understand our responsibility to protect the individual’s interests.
• We have conducted a legitimate interests assessment (LIA) and kept a record of it, to ensure that we can justify our decision.
• We have identified the relevant legitimate interests.
• We have checked that the processing is necessary and there is no less intrusive way to achieve the same result.
• We have done a balancing test and are confident that the individual’s interests do not override those legitimate interests.
• We only use individuals’ data in ways they would reasonably expect, unless we have a very good reason.
• We are not using people’s data in ways they would find intrusive or which could cause them harm, unless we have a very good reason.
• If we process children’s data, we take extra care to make sure we protect their interests.
• We have considered safeguards to reduce the impact where possible.
• We have considered whether we can offer an opt out.
• If our LIA identifies a significant privacy impact, we have considered whether we also need to conduct a DPIA.
• We keep our LIA under review and repeat it if circumstances change.
• We include information about our legitimate interests in our privacy notice.

What’s New?

The concept of legitimate interests as a lawful basis for processing is essentially the same as the equivalent Schedule 2 condition in the 1998 Act, with some changes in detail.

You can now consider the legitimate interests of any third party, including wider benefits to society. And when weighing against the individual’s interests, the focus is wider than the emphasis on ‘unwarranted prejudice’ to the individual in the 1998 Act. For example, unexpected processing is likely to affect whether the individual’s interests override your legitimate interests, even without specific harm.

The GDPR is clearer that you must give particular weight to protecting children’s data.

Public authorities are more limited in their ability to rely on legitimate interests and should consider the ‘public task’ basis instead for any processing they do to perform their tasks as a public authority. Legitimate interests may still be available for other legitimate processing outside of those tasks.

The biggest change is that you need to document your decisions on legitimate interests so that you can demonstrate compliance under the new GDPR accountability principle. You must also include more information in your privacy notice.

In the run up to 25 May 2018, you need to review your existing processing to identify your lawful basis and document where you rely on legitimate interests, update your privacy notice, and communicate it to individuals.

What is the Legitimate Interests basis?

Article 6(1)(f) gives you a lawful basis for processing where: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests of the fundamental rights and freedoms of the data subject which require protection of personal data, in particular, where the data subject is a child. 

Very little. The lawful basis for processing necessary for compliance with a legal obligation is almost identical to the old condition for processing in paragraph 3 of Schedule 2 of the 1998 Act.

You need to review your existing processing so that you can document where you rely on this basis and inform individuals. But in practice, if you are confident that your existing approach complied with the 1998 Act, you are unlikely to need to change your existing basis for processing.

What does the GDPR say?

Article 6(1)(c) gives you a lawful basis for processing where: processing is necessary for compliance with a legal obligation to which the controller is subject.  

When is the lawful basis for legal obligations likely to apply?

In short, when you are obliged to process the personal data to comply with the law.

Article 6(3) requires that the legal obligation must be laid down by UK or EU law. Recital 41 confirms that this does not have to be an explicit statutory obligation, as long as the application of the law is foreseeable to those individuals subject to it. So, it includes clear common law obligations.

This does not mean that there must be a legal obligation specifically requiring the specific processing activity. The point is that your overall purpose must be to comply with a legal obligation which has a sufficiently clear basis in either common law or statute.

You should be able to identify the obligation in question, either by reference to the specific legal provision or else by pointing to an appropriate source of advice or guidance that sets it out clearly. For example, you can refer to a government website or to industry guidance that explains generally applicable legal obligations.

When is processing necessary for a contract?

‘Necessary’ does not mean that the processing must be essential for the purposes of performing a contract or taking relevant pre-contractual steps. However, it must be a targeted and proportionate way of achieving that purpose. This lawful basis does not apply if there are other reasonable and less intrusive ways to meet your contractual obligations or take the steps requested.

The processing must be necessary to deliver your side of the contract with this particular person. If the processing is only necessary to maintain your business model more generally, this lawful basis will not apply and you should consider another lawful basis, such as legitimate interests.

This does not mean that processing which is not necessary for the contract is automatically unlawful, but rather that you need to look for a different lawful basis.

Regulatory requirements also qualify as a legal obligation for these purposes where there is a statutory basis underpinning the regulatory regime and which requires regulated organisations to comply.

A contractual obligation does not comprise a legal obligation in this context. You cannot contract out of the requirement for a lawful basis. However, you can look for a different lawful basis. If the contract is with the individual you can consider the lawful basis for contracts. For contracts with other parties, you may want to consider legitimate interests.

When is processing necessary for Compliance?

Although the processing need not be essential for you to comply with the legal obligation, it must be a reasonable and proportionate way of achieving compliance. You cannot rely on this lawful basis if you have discretion over whether to process the personal data, or if there is another reasonable way to comply.

It is likely to be clear from the law in question whether the processing is actually necessary for compliance.

What else should we consider?

If you are processing on the basis of legal obligation, the individual has no right to erasure, right to data portability, or right to object. Read our guidance on individual rights for more information.

Remember to:

• document your decision that processing is necessary for compliance with a legal obligation;
• identify an appropriate source for the obligation in question; and
• include information about your purposes and lawful basis in your privacy notice.