Since the question is about cookies, an answer that is based solely of the GDPR
would be incomplete.
The confusing facts are that:
- It is the
- It is the GDPR that controls the data which cookies process.
The GDPR defines six grounds for keeping user data that include Consent, Contract,
Legal obligation, Vital interests, Public task and Legitimate interests.
But because of the ePrivacy Directive, it is Consent that is mandatory, much before
Legitimate interests. This means that Legitimate interest must still require consent.
Even if the website deems processing to be necessary, legitimate interest must
be weighed against the fundamental rights and freedoms of the users.
The GDPR highlights the following as specific types of processing that are
considered legitimate interest:
- Fraud prevention
- Network and information security
- Indicating possible criminal acts or threats to public security
- Processing employee or client data, direct marketing and intra-group administrative
transfers will probably also be considered legitimate interest.
Recital (47) of the GDPR says: “The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest”.
But the word "may" here does not give the website carte blanche for keeping user data.
The website must balance its interests against the individual’s.
If the individual would not reasonably expect the processing,
or if it would cause unjustified harm, his interests override
the website's legitimate interests.
Legitimate interest is actually pretty troublesome to use by a website.
The website must document its justifications for using it, and must supply
this documentation for any inquiry by users or the authorities.
It must include details of its legitimate interests in its privacy information.
It must also keep a record of its legitimate interests assessment (LIA),
to help demonstrate compliance if required.
To that end, the UK’s data protection authority, suggests using a
that includes the following:
- Purpose test – is there a legitimate interest behind the processing?
- Necessity test – is the processing necessary for that purpose?
- Balancing test – is the legitimate interest overridden by the individual’s
interests, rights or freedoms?
Having good answers available for all these three points is required to
demonstrate legitimate interest. This rather heavy process should make a website
think twice before claiming legitimate interest.