On 9 April 2014, the Article 29 Data Protection Working Party (the "Working Party"), an independent European advisory body on data protection and privacy comprised of representatives from the national data protection authorities of the EU Member States, the European Data Protection Supervisor and the European Commission, adopted an opinion (the "Opinion") analysing the criteria set down in Article 7(f) of Directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data (the "Data Protection Directive"). Given the lack of harmonised interpretation of this provision throughout the EU and as work towards a new general Data Protection Regulation continues (the "proposed Regulation" - See, VBB on Belgian Business Law, Volume 2013, No. 2, p. 11, available at www.vbb.com), the Working Party committed to draft this Opinion.
Article 7(f) of the Data Protection Directive is the last of six grounds for the lawful processing of personal data. It permits the processing of personal data based on the balancing of the interests involved. In particular, the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, must outweigh the interests or fundamental rights and freedoms of the data subject.
The Opinion stresses the autonomous significance and usefulness of the Article 7(f) criterion. It should not be treated as 'a last resort' for rare or unexpected situations where other grounds for legitimate processing are deemed not to apply. On the other hand, it should also not be seen as a preferred option and its use must not unduly be extended because it would be considered as less constraining than the other grounds.
The Opinion indicates that a proper Article 7(f) assessment is not a straightforward balancing test, but requires full consideration of a number of factors in order to ensure that the interests and fundamental rights of data subjects are taken into account.
As a result, factors that need to be considered when carrying the balancing test include:
(i) Weighing controller's legitimate interest
First, the controller must pursue a legitimate interest by processing the personal data. The Opinion defines an interest as the broader stake that a controller may have in the processing, or the benefit that it derives - or that society might derive - from the processing. The nature and source of the interest may vary, including...