The Future of Privacy Forum and NYMITY collaborated to create this Report and identify specific cases that have been decided at the national level by Data Protection Authorities (DPAs) and Courts from the European Economic Area (EEA), as well as the most relevant cases where the Court of Justice of the European Union interpreted and applied the “legitimate interests” ground.
They looked at cases across industries and we compiled them in two lists: one for uses of this ground that were found lawful and one for uses that were found unlawful. All of them contain useful examples of how the “balancing exercise” is conducted in practice, as well as examples of safeguards that were needed to tilt the balance and make the processing lawful. Some of them have short comments at the end of the summary that point out interesting features of the case.