Legitimate interest

In short: Legitimate interest allows data processing without consent if it is necessary for a legitimate interest and the rights of the data subject do not override it.

In more detail: A three-step test is needed: Is there a legitimate interest? Is the processing necessary for it? Do the person’s interests or fundamental rights not override it? Examples are fraud prevention, IT security or limiting abuse with rate limits.

In Depth

• Document the balancing: Whoever relies on it should record the balancing in writing.
• Right to object: Data subjects can object (Art. 21).
• Expectations of the person: What is reasonably to be expected plays into the balancing.
• Not for: special categories, and not for tracking for advertising purposes on the device without consent (TDDDG).
• Example here: server logs and abuse limitation (daily limits) when submitting suggestions.

See also: GDPR: principles and legal bases, Consent under the GDPR