Companies can’t default to legitimate interest for data use, EU privacy guidance says
( November 11, 2026, 11:00 GMT | Official Statement) -- MLex Summary: Companies must assess and document why their use of personal data is necessary and doesn’t override individuals’ rights before relying on “legitimate interests,” according to guidelines adopted by the European Data Protection Board on Tuesday. The board, which brings together national privacy regulators, said this legal basis under the General Data Protection Regulation must not become a default option simply because companies see it as less demanding than alternatives.The guidelines, an annex and a summary are attached....
Prepare for tomorrow’s regulatory change, today
MLex identifies risk to business wherever it emerges, with specialist reporters across the globe providing exclusive news and deep-dive analysis on the proposals, probes, enforcement actions and rulings that matter to your organization and clients, now and in the longer term.
Know what others in the room don’t, with features including:
- Daily newsletters for Antitrust, M&A, Trade, Data Privacy & Security, Technology, AI and more
- Custom alerts on specific filters including geographies, industries, topics and companies to suit your practice needs
- Predictive analysis from expert journalists across North America, the UK and Europe, Latin America and Asia-Pacific
- Curated case files bringing together news, analysis and source documents in a single timeline
Experience MLex today with a 14-day free trial.