When Legitimate Interest Meets Real People

A narrowed public-web dataset may still contain personal data, so the next question is whether the remaining processing can be justified in light of the people represented in it. The EDPB guidance describes legitimate interest as a cumulative analysis, not a general business-purpose exception. Readers can use that analysis to separate a real and articulated interest from mere commercial convenience, test whether the processing is necessary, and understand why the answer changes with the source, the people, the scale, and the likely effects of model development.

The analysis is especially important because a person’s interest is not limited to avoiding a secret collection. It can include control over their information, the ability to speak without being unexpectedly identified, and protection from uses that change the consequences of publication. A public page may be visible, but a model can combine, infer, reproduce, and distribute information in ways that the original setting did not make obvious.

A legitimate interest must survive three questions

Under Article 6(1)(f) of the GDPR, legitimate interest can provide a lawful basis where processing is necessary for the legitimate interests of the controller or a third party, unless the interests or fundamental rights and freedoms of the person concerned override that interest. The EDPB presents three cumulative conditions. All three must be addressed; a strong answer to one does not compensate for a failure at another.

First: what is the interest?

An interest is broader than the immediate purpose of a processing operation. The purpose might be to collect text from particular sources; the interest might be to develop or improve a service. The EDPB says a legitimate interest should be lawful, clearly and precisely articulated, and real and present rather than speculative.

That standard separates an actual objective from a vague claim that more data might be useful someday. A project developing a conversational agent may be able to describe a concrete service objective. A project improving fraud detection or threat detection may be able to identify a defined protective function. A general-purpose model presents a harder question when its precise use has not yet been selected. The EDPB says the objective pursued by the development should still be described, including whether it is commercial, public, scientific, internal, or external.

The interest also has to be connected to the data and the proposed processing. A company’s desire to build a valuable model may be real, but that statement alone does not explain why it needs a particular source, category of personal data, or period of historical material. A clear interest gives the project something against which necessity and impact can be measured. Without that specificity, the balancing stage has no stable description of what people’s interests are being asked to yield to.

Second: is the processing necessary?

Necessity asks two related questions: will the processing allow the project to pursue the interest, and is there an equally effective but less intrusive way to pursue it? The EDPB’s formulation makes necessity more demanding than usefulness. Data can improve a model and still be unnecessary if the same objective could be reached through a narrower collection or a different type of data.

This is where upstream minimisation becomes part of the legal reasoning. Narrowing the collection criteria may exclude unnecessary personal data. Synthetic data may reduce exposure. Pseudonymised data may limit direct identification.