ICC POLICY STATEMENT

ICC position on legitimate interests

This policy statement outlines the International Chamber of Commerce’s (ICC) position about the provision for establishing a data controller or third party’s legitimate interests as a legal basis for processing data.

ICC emphasizes the critical importance of the provision in a rapidly changing environment, demands innovative uses of data, and urges its inclusion in the proposed General Data Protection Regulation on data protection currently under consideration.

Furthermore, it highlights that when taken as a whole — including its requirements for transparency and the need to consider legitimate interests in relation to the fundamental rights of data subjects — the provision requires necessary analysis to promote appropriate decisions by the data controller.

The comments discourage policymakers from instituting an exclusive list of legitimate business purposes. Instead, it encourages the development, in consultation with business and other interested stakeholders, of guidance for data controllers about how this provision can be responsibly and practically applied.