On 9 April 2014, the Article 29 Data Protection Working Party (the "Working Party"), an independent European advisory body on data protection and privacy comprised of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor and the European Commission, adopted an opinion (the "Opinion") analysing the criteria set down in Article 7(f) of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive"). Given the lack of harmonised interpretation of this provision throughout the EU and as work towards a new general Data Protection Regulation continues (the "proposed Regulation" - See, VBB on Belgian Business Law, Volume 2013, No. 2, p. 11, available at www.vbb.com), the Working Party committed to draft this Opinion.

Article 7(f) of the Data Protection Directive is the last of six grounds for the lawful processing of personal data. It permits the processing of personal data based on the balancing of the interests involved. In particular, the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, must outweigh the interests or fundamental rights and freedoms of the data subject.

The Opinion stresses the autonomous significance and usefulness of the Article 7(f) criterion. It should not be treated as 'a last resort' for rare or unexpected situations where other grounds for legitimate processing are deemed not to apply. On the other hand, it should also not be seen as a preferred option and its use must not unduly be extended because it would be considered as less constraining than the other grounds.

The Opinion indicates that a proper Article 7(f) assessment is not a straightforward balancing test, but requires full consideration of a number of factors in order to ensure that the interests and fundamental rights of data subjects are taken into account.

As a result, factors that need to be considered when carrying the balancing test include:

(i) Weighing controller's legitimate interest

First, the controller must pursue a legitimate interest by processing the personal data. The Opinion defines an interest as the broader stake that a controller may have in the processing, or the benefit that it derives – or that society might derive – from the processing. The nature and source of the interest may vary, including whether the data processing is necessary for the exercise of a fundamental right, or is otherwise in the public interest or benefits from social, cultural or legal/regulatory recognition in the community concerned. In order to be relevant under Article 7(f), a legitimate interest must further (i) be lawful, i.e. in accordance with applicable EU and national law; (ii) be sufficiently clearly articulated to allow the balancing test to be carried out; and (iii) represent a real and present interest, i.e. not be speculative.

(ii) Weighing data subjects' interest

Second, the other side of the balance, the impact of the processing on the interests or fundamental rights of the data subject, is a crucial criterion. This notion of the data subjects' 'interests' is defined even more broadly as it does not require a 'legitimacy' element. All categories of interests are taken into account as long as they are relevant to the Data Protection Directive. The Opinion indicates that both positive and negative consequences of the data processing should be considered. These may include situations where there is a risk of damaging the reputation, negotiating power, or autonomy of the data subject, but also broader, emotional consequences. The following factors have to play a role: (i) the nature of the data; (ii) the way data are being processed; (iii) the reasonable expectations of the data subject; and (iv) the status of the data controller and data subject, including the balance of power between them.

Finally, based on an analysis and weighing of the two sides against each other, a provisional 'balance' may be established. If the outcome is unclear, additional safeguards may be considered to ensure a fair balance, such as data minimisation; privacy-enhancing technologies; increased transparency; general and unconditional right to opt-out; and data portability.

For the future, the Working Party recommends implementing a recital to the proposed Regulation on the key factors to consider when applying the balancing test, as well as a recital requiring the controller, when appropriate, to document its assessment in the interests of greater accountability. Finally, the Working Party also supports including a substantive provision for controllers to explain why they believe their interests would not be overridden by the data subjects' interests, fundamental rights and freedoms.

The full text of the Opinion can be consulted here

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.