| name | legit-interest-vs-consent |
| title | Assessing Legitimate Interest vs Consent |
| description | Decision framework for choosing between consent and legitimate interest as the lawful basis for processing. Covers power imbalance indicators, conditionality prohibition under Article 7(4), granularity requirements, the three-part LIA test (purpose, necessity, balancing), and practical decision trees for common scenarios. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/legit-interest-vs-consent |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | general |
| practice | data-protection |
| language | en |
Assessing Legitimate Interest vs Consent
Overview
GDPR Article 6(1) provides six lawful bases for processing. Consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)) are the two most commonly used bases for commercial data processing. Choosing the wrong basis creates compliance risk: relying on consent when it cannot be freely given undermines validity, while relying on legitimate interest when consent is required (e.g., for electronic marketing under the ePrivacy Directive) violates sectoral law.
Decision Framework: When to Use Each Basis
Use Consent When:
- Regulatory requirement: Specific legislation mandates consent (e.g., ePrivacy Directive Article 5(3) for non-essential cookies, Article 13 for unsolicited electronic marketing)
- Special category data: Processing sensitive data under Article 9(2)(a) requires explicit consent
- Automated decision-making: Processing under Article 22(2)(c) requires explicit consent
- International transfers: Article 49(1)(a) explicit consent for transfers without adequacy/safeguards
- User control priority: The processing is entirely optional and the data subject should have full control
Use Legitimate Interest When:
- Power imbalance exists: Consent cannot be freely given (employer-employee, public authority-citizen)
- Processing is necessary: The processing is necessary for the controller's or third party's legitimate interest and is proportionate
- Reasonable expectation: The data subject would reasonably expect the processing (Recital 47)
- Withdrawal would be problematic: If consent withdrawal would cause operational issues (e.g., fraud prevention)
- No specific consent requirement: No ePrivacy or sectoral law mandates consent
Power Imbalance Indicators
Per EDPB Guidelines 05/2020 (paragraphs 13-25) and Recital 43, consent is presumed not to be freely given when a clear imbalance exists:
| Indicator | Example | Implication |
|---|
| Employment relationship | Employer asks employee to consent to monitoring | Use LI or legal obligation, not consent |
| Public authority | Tax authority processes taxpayer data | Use legal obligation or public task |
| Service dependency | Only provider in market; user has no alternative |
