Legitimate interest (Article 6(1)(f)) allows processing of personal data when it is necessary for the controller's legitimate interests, unless those interests are overridden by the individual's interests. It is the most common legal basis cited for AI system data processing — and also the one most frequently challenged by data protection authorities.
The Three-Part Test
1. Purpose test: is the interest legitimate?
The interest must be lawful and represent a real benefit. For AI systems: model improvement, fraud prevention, and personalisation are generally legitimate interests. There is no legitimate interest in processing personal data purely for commercial gain without a clearly articulated benefit to the individual or society.
2. Necessity test: is processing necessary?
Processing must be necessary to achieve the stated purpose — not merely useful or convenient. If the same purpose can be achieved with anonymised or pseudonymised data, processing identifiable personal data fails the necessity test. Many AI training use cases fail here: models can often be trained on synthetic or anonymised data.
3. Balancing test: do individual interests override?
The most important and most commonly skipped step. Consider: the reasonable expectations of individuals at the time of data collection (did they expect this use?), the impact of processing on individuals, and the existence of safeguards. AI training on conversational data often fails this test when users had no reasonable expectation their conversations would be used as training data.
Where AI Use Cases Commonly Fail
- ▸Model training on customer support conversations without specific consent — individuals did not expect training use
- ▸Inference logging with indefinite retention — individuals cannot reasonably expect perpetual retention of their queries
- ▸Cross-context personalization — using data from one service to personalize another without adequate notice
- ▸Profiling for automated decisions — the balancing test rarely supports automated individual decisions on legitimate interest alone
Legitimate interest assessments must be documented. A DPA investigation that finds you are relying on legitimate interest without a documented LIA is itself a compliance finding, regardless of whether the underlying processing is defensible.