“In our analysis of the information available on UK charity scandal the other day, one of the main points we focused on was the use of legitimate interests as a legal grounds for processing personal data. This condition for processing is currently being visited in trilogue discussion of Chapter II of the EU Data Protection Regulation.
As we noted yesterday, EU Council of Ministers draft of the Data Protection Regulation proposes expanding the potential scope for the “legitimate interests” processing condition on the basis that it is “good for business” to allow new and novel processing purposes solely on the basis of the “legitimate interests” of an organisation. This current scandal shows one way in which direct marketing does look to be pretty clearly violating the rights of an individual.” – Katherine O’Keefe, Castlebridge Associates, September 3rd 2015
Direct marketing and legitimate interests are two phrases which hand in hand cause me more confusion than the layout of Ikea. GDPR says that some direct marketing can be sent so long as the activity doesn’t override the rights of the individual. What this means in reality is about as clear as mud.
This article from Katherine O’Keefe seeks to provide clarification on this murky subject where the EU have not. It makes for an eye opening read from which one could conclude that marketing based on the premise of legitimate interests risks treading on dangerous ground.