Understanding Legitimate Interest under the GDPR: A Study of the CJEU Case C-621/22 and the EDPB Guidelines - Global Privacy Law Review View Understanding Legitimate Interest under the GDPR: A Study of the CJEU Case C-621/22 and the EDPB Guidelines by - Global Privacy Law Review Understanding Legitimate Interest under the GDPR: A Study of the CJEU Case C-621/22 and the EDPB Guidelines 6 1

The Court of Justice of the European Union (CJEU) ruling in Case C-621/22 provides certainty regarding the possibility to qualifying commercial interests as legitimate interests under Article 6(1)(f) of the General Data Protection Regulation (GDPR). The CJEU enumerates the criteria that must be fulfilled and confirms that direct marketing falls under the notion of legitimate interest. The decision was published simultaneously with the new guidelines of the European Data Protection Board (EDPB), which aim to provide further guidance to data controllers on how to assess in practice if a data controller’s interests constitute legitimate interests under the GDPR and can therefore justify the processing of personal data.

Global Privacy Law Review