legit-interest-vs-consent

Assessing Legitimate Interest vs Consent

Overview

GDPR Article 6(1) provides six lawful bases for processing. Consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)) are the two most commonly used bases for commercial data processing. Choosing the wrong basis creates compliance risk: relying on consent when it cannot be freely given undermines validity, while relying on legitimate interest when consent is required (e.g., for electronic marketing under the ePrivacy Directive) violates sectoral law.

Decision Framework: When to Use Each Basis

Use Consent When:

1. Regulatory requirement: Specific legislation mandates consent (e.g., ePrivacy Directive Article 5(3) for non-essential cookies, Article 13 for unsolicited electronic marketing)
2. Special category data: Processing sensitive data under Article 9(2)(a) requires explicit consent
3. Automated decision-making: Processing under Article 22(2)(c) requires explicit consent
4. International transfers: Article 49(1)(a) explicit consent for transfers without adequacy/safeguards
5. User control priority: The processing is entirely optional and the data subject should have full control

Use Legitimate Interest When:

1. Power imbalance exists: Consent cannot be freely given (employer-employee, public authority-citizen)
2. Processing is necessary: The processing is necessary for the controller's or third party's legitimate interest and is proportionate
3. Reasonable expectation: The data subject would reasonably expect the processing (Recital 47)
4. Withdrawal would be problematic: If consent withdrawal would cause operational issues (e.g., fraud prevention)
5. No specific consent requirement: No ePrivacy or sectoral law mandates consent

Power Imbalance Indicators

Per EDPB Guidelines 05/2020 (paragraphs 13-25) and Recital 43, consent is presumed not to be freely given when a clear imbalance exists:

Indicator	Example	Implication
Employment relationship	Employer asks employee to consent to monitoring	Use LI or legal obligation, not consent
Public authority	Tax authority processes taxpayer data	Use legal obligation or public task
Service dependency	Only provider in market; user has no alternative	Consent may not be freely given
Contractual bundling	Consent required as condition of contract (Art. 7(4))	Consent likely invalid
Vulnerable data subjects	Children, elderly, patients	Extra scrutiny; consent may not be free
Significant consequence	Refusing consent leads to job loss or service termination	Consent not freely given