NEWS
There is a common misconception that, in Europe at least, a company needs your consent in order to use your personal data.
This misunderstanding was highlighted recently when LinkedIn posted a banner to its European users, stating that, unless they opt out, LinkedIn will start using their data to train its AI systems. This triggered an outcry that LinkedIn was using “sneaky” tactics to get people’s consent for this new use of their data.
The truth is that, with a limited number of exceptions (such as direct marketing, unnecessary cookies or using sensitive data such as health information), companies do not need consent to use the data of people in Europe.
In the LinkedIn case, the company decided that it will use people’s data to train its AI systems, not based on their consent, but because it believes it has a legitimate business interest to do so. Of course, for this, it still needed to inform users (which it did using the banner) and allow them to object (which it did by providing the opt-out option).
In other words, LinkedIn was not doing a bad job of asking for consent but rather a reasonably good job of meeting its obligations to rely on legitimate interest.
The real debate is not whether LinkedIn was gathering valid consent (it wasn’t) but rather whether LinkedIn’s legitimate interests aren’t overridden by the interests of the people concerned.
As a reminder, there are three conditions that must be met before a controller can successfully rely on the legitimate interest legal basis for processing:
- The pursuit of a legitimate interest by a controller or third party (legitimate interest).
- The need to process personal data for the purposes of legitimate interest (necessity test).
- The interests of data subjects’ rights and freedoms do not outweigh the legitimate interests of the controller or third party (balancing test).
Talk to Quarmans today – and discover how we support organisations at all data privacy maturity levels.
Roger Williams Director Quarmans
