During the Plenary of the European Data Protection Board (EDPB), which took place on 7 and 8 October 2024, the following documents relevant for ensuring an adequate application of the General Data Protection Regulation were adopted:

a) Guidelines 1/2024 on the processing of personal data based on Article 6 (1)(f) GDPR (legitimate interest), in public consultation until 20.11.2024;

This guide analyses the criteria provided by Article 6(1)(f) of the GDPR that controllers have to comply with in order to legally process personal data based on legitimate interest, taking also into consideration the recent judgement of the Court of Justice of the European Union in case C-621/22 of 4 October 2024.

As such, for processing to be based on the legitimate interest legal basis, the controller has to fulfil three cumulative conditions:

the pursuit of a legitimate interest by the controller or by a third party;
the need to process personal data for the purposes of the legitimate interest(s) pursued;
the interests or fundamental freedoms and rights of the concerned data subjects do not take precedence over the legitimate interest(s) of the controller or of a third party.

b) Opinion no. 22/2024 on certain obligations following from the reliance on processor(s) and sub-processor(s).

This opinion refers to the situations in which controllers engage one or more processors and, by case, sub-processors, addressing the interpretation of certain obligations of controllers as well as the content of the contracts between the controller and the processor, arising in particular from Article 28 of the GDPR.

More information available at: https://edpb.europa.eu/news

Legal and Communication Department

A.N.S.P.D.C.P.