Understanding the balancing act behind the legitimate interest of the controller ground: A pragmatic approach

De Hert and Kamara analyse the provision of the legitimate interest ground in the new EU data protection framework, the General Data Protection Regulation. The authors explain that the rationale of the legitimate interest ground is that under certain conditions, controllers’ or third parties’ interests might be justified to prevail over the interests, rights, and freedoms of the data subject. When and how the prevailing may take place under the GDPR provisions is not a one-dimensional assessment. De Hert and Kamara suggest a formalisation of the legitimate interest ground steps towards the decision of the controller on whether to base his or her processing on the legitimate interest ground. They argue that the legitimate interest ground should not be seen in isolation, but through the lens of the data protection principles of Article 5 GDPR and Article 8 Charter Fundamental Rights EU. The authors further analyse the relevant case law of the Court of Justice EU, as well as the cases of Network and Information Security and Big Data and Profiling. Kamara and De Hert conclude that the legitimate interest of the controller is not a loophole in the data protection legislation, as it has often been criticised, but an equivalent basis for lawful processing, that can distinct controllers in bad faith from controllers processing data in good faith