legit-interest-vs-consent

name	legit-interest-vs-consent
title	Assessing Legitimate Interest vs Consent
description	Decision framework for choosing between consent and legitimate interest as the lawful basis for processing. Covers power imbalance indicators, conditionality prohibition under Article 7(4), granularity requirements, the three-part LIA test (purpose, necessity, balancing), and practical decision trees for common scenarios.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/skills/privacy/legit-interest-vs-consent
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	general
practice	data-protection
language	en

Assessing Legitimate Interest vs Consent

Overview

GDPR Article 6(1) provides six lawful bases for processing. Consent (Article 6(1)(a)) and legitimate interest (Article 6(1)(f)) are the two most commonly used bases for commercial data processing. Choosing the wrong basis creates compliance risk: relying on consent when it cannot be freely given undermines validity, while relying on legitimate interest when consent is required (e.g., for electronic marketing under the ePrivacy Directive) violates sectoral law.

Decision Framework: When to Use Each Basis

Use Consent When:

1. Regulatory requirement: Specific legislation mandates consent (e.g., ePrivacy Directive Article 5(3) for non-essential cookies, Article 13 for unsolicited electronic marketing)
2. Special category data: Processing sensitive data under Article 9(2)(a) requires explicit consent
3. Automated decision-making: Processing under Article 22(2)(c) requires explicit consent
4. International transfers: Article 49(1)(a) explicit consent for transfers without adequacy/safeguards
5. User control priority: The processing is entirely optional and the data subject should have full control

Use Legitimate Interest When:

1. Power imbalance exists: Consent cannot be freely given (employer-employee, public authority-citizen)
2. Processing is necessary: The processing is necessary for the controller's or third party's legitimate interest and is proportionate
3. Reasonable expectation: The data subject would reasonably expect the processing (Recital 47)
4. Withdrawal would be problematic: If consent withdrawal would cause operational issues (e.g., fraud prevention)
5. No specific consent requirement: No ePrivacy or sectoral law mandates consent

Power Imbalance Indicators

Per EDPB Guidelines 05/2020 (paragraphs 13-25) and Recital 43, consent is presumed not to be freely given when a clear imbalance exists:

Indicator	Example	Implication
Employment relationship	Employer asks employee to consent to monitoring	Use LI or legal obligation, not consent
Public authority	Tax authority processes taxpayer data	Use legal obligation or public task
Service dependency	Only provider in market; user has no alternative