Legitimate Interest

For a long time the only answer to handling personal data was to get consent — telling people what you collect and why, then asking them to agree in advance. But some processing falls apart the moment you ask. Imagine asking someone who is spinning up fake accounts by the hundred whether you may look at their sign-up logs to check for abuse. Anyone who says no drops out of the check, and a check that skips exactly the people it targets checks nothing.

Pagedeck ran into that scene. Hundreds of free accounts were being created every day and blasting advertising documents, so Theo proposed comparing sign-up logs to filter them out. The meeting stalled the moment someone suggested adding one more consent checkbox to the sign-up screen.

Piling on consent items has its own cost. Put nine checkboxes in front of a user and they tick "select all" without reading, and the permissions collected that way confirm nothing.

Legitimate interest exists to handle both problems at once. Processing that a company genuinely has to do, and that the person would broadly expect, can happen without asking — on the condition that the company works out for itself why that is acceptable and writes the reasoning down. The burden of judgment moves off the user's checkbox and onto the company.

The ground stands once you answer three questions in order and record the answers. Fail one and you don't move to the next.

1. Is the purpose legitimate? Write down in one sentence what the processing is for. "We keep the sign-up IP address and device details for 30 days to block fraudulent registrations" is narrow enough. Something as broad as "improving the service" leaves you unable to answer the next question.
2. Is it necessary for that purpose? If a less intrusive method reaches the same goal, the ground fails here. When counting how many accounts one person opened in a few days is enough to catch the abuse, there is no reason to collect device details as well.
3. Does it override the data subject's rights? The data subject is the person the information belongs to. Put what the company gains next to what that person loses and weigh them. Whether the processing is something a user would expect, whether the fields are sensitive ones like health or beliefs, and whether children are involved all get decided here.

The third question is where the verdict actually lands. Korea's Personal Information Protection Act (PIPA) recognises this ground only where the interest clearly overrides the person's rights, so a close call should be read as a failure.

The party making the call is the data controller — the company that decides what gets collected and why. Even when someone else runs the servers, the company that set the purpose sits in that seat. The document holding this reasoning is usually called a balancing test record. It is what you hand over when a regulator or an enterprise customer asks why you processed data without asking, and reasoning you did but never wrote down is indistinguishable from reasoning you never did.

Having the ground doesn't retire the other obligations. The privacy policy still has to state what you process on which ground, data minimization still limits you to the fields the purpose needs, and a retention period still has to be set and acted on. The only thing this ground excuses is the step of asking.

It turns up most in the work of blocking abuse and keeping a service running — processing a user has no particular reason to authorise, but would be hurt by if it stopped.

1. Fraudulent sign-ups and payment fraud detection. Sign-up and checkout logs are kept briefly so the same pattern can be filtered out. Block this and legitimate users absorb the spam documents and the stolen card charges.
2. Operations and incident records. Knowing who hit which error on which screen is what makes root causes findable. Without the logs there is no way to reproduce the same outage.
3. Internal information security. Access records on staff accounts get reviewed to catch reads outside someone's permissions.

The places where the ground does not stand are clearer still. Collecting behavioural records to build a new advertising audience, handling sensitive fields like health or political views, processing children's data, and passing collected data to another company are all outside it, however much the company stands to gain.

The scope also varies by country, which bites in practice. Europe's General Data Protection Regulation (GDPR) treats this as one of six lawful bases and reads it broadly; Korea reads it narrowly. A product like Pagedeck that serves users on both sides saves itself trouble by building to the narrower rule.

"Instead of adding another consent item, can't we run this on legitimate interest?"

Asking whether a different ground can carry the processing rather than bolting one more checkbox onto the sign-up screen.

"If we're going with legitimate interest, get me the balancing test record first."

Reasoning that isn't written down leaves nothing to explain later.

"The balance doesn't work. For a marketing purpose, consent is the right call."

A judgment that the harm to users outweighs the company's gain, so this ground is unavailable.

These lines came up at Pagedeck while shipping the fraudulent sign-up filter. Theo cut the fields down to the IP address and browser details, Grace wrote out answers to the three questions and filed them, and Mia added a line to the privacy policy and put automatic deletion of 30-day-old records into the next cycle. The feature itself was a day's work; meeting the conditions for shipping it took that much again.

The name invites people to read it as a ground available whenever the company benefits, and the practical wish to shrink the consent screen makes that reading even easier. Having an interest only means the first question passed; necessity and balance are still waiting. Skip those two and the processing counts as collection without a basis, which brings corrective orders and fines — and any feature built on that data has to come out along with the data.

Another frequent mistake is reading it as permission to say nothing. Since nobody is asked, notice feels optional too, but the only exemption is the asking. What you process and on what ground still belongs in the privacy policy, and users still need a channel to object and have the processing stopped. Leave that out and people learn how their data was used only after a breach, at which point trust breaks first, regardless of whether the ground was lawful.