The European Data Protection Board has published a reasoned review dedicated to the legal basis of legitimate interest, built on the decisions taken by European privacy authorities in cross-border proceedings managed with the one-stop-shop mechanism  provided for by the GDPR.

These are therefore particularly significant cases, because they reflect shared assessments between several supervisory authorities on treatments that produce effects in several Member States.

The document has a very practical slant and shows how the authorities apply, in concrete cases, the three-step test required to base the processing on Article 6, paragraph 1, letter f), GDPR: the presence of a legitimate interest of the controller, the necessity of the processing with respect to that interest and the balancing with the fundamental rights and freedoms of the data subjects. The review not only indicates the cases in which the use of legitimate interest has been deemed admissible, but also highlights the situations in which this legal basis has been considered insufficient or used incorrectly.

One of the most interesting aspects is the link with the EDPB Guidelines 1/2024, of which the document offers a sort of practical application, flanked by references to the case law of the Court of Justice of the European Union and to further national decisions. A useful framework emerges to understand that legitimate interest is not an "elastic" legal basis to be invoked in a generic way, but requires a concrete, documented and verifiable motivation.

For companies, DPOs and consultants, the review therefore represents a valuable reference to assess in a more realistic way when the legitimate interest can really stand up to the scrutiny of the European authorities.