[Note: This post was originally published on the CiTiP Blog]
Balancing exercises permeate data protection law. This post investigates the interaction between two core manifestations of such balancing in the GDPR: the last lawful ground (Art.6(1)f) and the right to object (Art.21(1)).
Balancing in Article 6(1): From lawfulness to guiding principle?
Balancing exercises play a pivotal role in the General Data Protection Regulation (GDPR). They are implied in concepts such as fairness and proportionality that permeate the GDPR. The centrepiece of balancing exercises within the Regulation is to be found in Article 6(1)f. This last lawful ground permits processing of personal data whenever ‘necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject’. In other words, this provision puts the legitimate interests of the controller and those of third parties against the interests, fundamental rights and freedoms of the data subject.
The balancing exercise put forward in Article 6(1)f arguably transcends merely being one lawful ground among the others. Indeed, the previous four grounds (necessary for (b) performance of a contract, (c) compliance with a legal obligation, (d) protect the data subject’s vital interests, (e) tasks carried out in the public interest), could be qualified as variations on a theme. They are simply situations where the interest in processing prevails by default. In light of the fairness principle, one may even claim that the first lawful ground on consent is subject to some level of balancing in light of Article 6(1)f. The very act of consenting can be qualified as a strong indicator that there is a balance. This is particularly true in light of the new Article 7, inter aliaputting forward the unconditional ability to withdraw one’s consent as well as guarding against all-or-nothing clauses.
The practical relevance of this consideration is that the lawfulness of any processing operation, regardless of its lawful ground, will have to be assessed in light of Article 6(1)f’s balancing exercise. The Art. 6(1)f balancing test will inform – not determine – the validity of the other lawful grounds. In sum, the balancing test in Article 6(1)f is the manifestation of the fairness principle (Article 5(1)a) in the form of a lawful ground. As such it can be used as a proxy for evaluating the validity of any of the lawful grounds.
Balancing and the right to object
The balancing exercise in Article 6(1)f can be qualified as an ex ante obligation. It needs to be complied with before the processing operation initiates. In practice, this balancing exercise will unilaterally be defined by the controller. Enter data subject rights. The rights to object and to erasure install ex post rights, effectively empowering data subjects to challenge the balance put forward by the controller. The right to object (Art.21) is particularly interesting in this regard, because it defines its very own balancing exercise. When a data subject objects ‘on grounds relating to his or her particular situation, […] the controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interest, rights and freedoms of the data subject […]’. As such, the right to object may be one of the clearest manifestations of the fairness principle in the shape of a data subject right.
Despite the striking resemblance between the balancing exercises in Articles 6(1)f and 21(1), there are some key differences. The right to object explicitly requires the data subject to put forward grounds relating to his/her particular situation, but at the same time puts the onus on the controller to establish overriding ‘compelling legitimate grounds’. The shift in burden of proof when compared to its predecessor (Art.14) in Directive 95/46, seems to have settled halfway. Both controller and data subject have one, though the controller’s is more onerous. In light of the accountability principle in Article 5(2), the burden of proof for establishing a balance under Art.6(1)f a priori lies with the controller alone. But, to all intents and purposes, when a data subject wishes to effectively challenge this balance, he/she will have to substantiate that claim.
Importantly, Art.21(1) does not include a reference to third party interests, which makes it seem more narrow than Art.6(1)f’s balance. Reading more closely, however, the provision merely requires the controller to demonstrate overriding ‘compelling legitimate grounds’. The language does not constrain these grounds to be of the controller alone and could therefore encompass much more than only ‘the interests pursued by the controller or by a third party’ in Art.6(1)f. This would render it harder for data subjects to exercise their right to object than to challenge the lawfulness of the processing operation(s) itself. This puzzling conclusion might partially be countered by the fact that Article 21(1) does not require the rights and freedoms of the data subject to be fundamental (contrary to Art.6(1)f).
Things get even more confusing when reading recital 69, which conflicts with Art.21(1) on three occasions, referring to (a) the controller’s own legitimate interests only; (b) ‘interests’ instead of ‘grounds’, the former being narrower; and (c) data subjects’ fundamental rights and freedoms. The end-result is that it is unclear how the balancing exercise under Art.21(1) should be performed exactly, leaving data subjects less empowered.
In conclusion, one may wonder what the added value of Article 21(1)’s balancing exercise is in the first place. Firstly, data subjects are free – at least in theory – to challenge lawful grounds (including Art.6(1)f) already anyway. Secondly, a closer look at Art.21(1) suggests that its balancing exercise is less likely to benefit data subjects than the one in Article 6(1)f. In light of data protection law’s rationale – routinely confirmed by the CJEU – the right to object should be interpret from the perspective of ensuring a high and effective level of protection. Such a systematic reading implies the right to object’s balancing exercise should be mirrored against (not equated to) the one in Art.6(1)f. The right to object can still be successful even though the processing is lawful stricto sensu under Article 6(1)f. The main added value of Art.21(1) therefore appears to be (a) allocating the burden of proof; and (b) empowering data subjects to challenge the status quo.
Tech, Policy & Society 