On October 8, 2024, the European Data Protection Board (EDPB) published the draft version of the Guidelines 1/2024 (“Guidelines”) for public consultation (open until November 20, 2024). These Guidelines examine the requirements and criteria for the processing of personal data based on legitimate interest, as provided in Article 6(1)(f) of the General Data Protection Regulation (GDPR). These long-awaited Guidelines clarify how controllers can rely on legitimate interest as a legal basis. They set out the cumulative criteria that must be met and emphasize the need for a detailed analysis before any processing operation.

In this Briefing, João Peixe highlights the key points presented in the Guidelines.