Tracing and legitimate interest vs consent

How GDPR (data protection) affects tracing

Private investigators are tasked to trace (people finder) individuals for a variety of reasons. From debt recovery motives to parents trying to regain contact with their children, there can be an almost infinite number of reasons why our detectives are tasked to locate people.

The new GDPR provisions lay a duty on private investigators to demonstrate that a legitimate interest is present in order to process the subject data and disclose their details to the client or a third party.

What does Article 6(1)(f) say about legitimate interests?

Legitimate interests is one of the six lawful bases for processing personal data. You must have a lawful basis in order to process personal data in line with the ‘lawfulness, fairness and transparency’ principle.

Article 6(1)(f) states: 

“1.Processing shall be lawful only if and to the extent that at least one of the following applies:

(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.”

The key elements of the legitimate interests provision can be broken down into a three-part test.

• Purpose test – is there a legitimate interest behind the processing?
• Necessity test – is the processing necessary for that purpose?
• Balancing test – is the legitimate interest overridden by the individual’s interests, rights or freedoms?

The GDPR does not have an exhaustive list of what purposes are likely to constitute a legitimate interest. However, the recitals do say the following purposes constitute a legitimate interest:

• fraud prevention;
• ensuring network and information security; or
• indicating possible criminal acts or threats to public security.

The recitals also say that the following activities may indicate a legitimate interest:

• processing employee or client data;
• direct marketing; or

• administrative transfers within a group of companies.

These examples of processing highlighted by the GDPR recitals are not exhaustive.

What are the individual’s ‘interests, rights and freedoms’?

The interests, rights and freedoms of individuals in this context is a broad concept which includes data protection and privacy rights, but also other fundamental rights as well as more general interests.

It is clear from other related provisions in the GDPR which talk about risks to the rights and freedoms of individuals that the focus here should be on any potential impact on individuals. Recital 75 provides some relevant guidance here. It makes clear that a risk to individuals’ rights and freedoms is about the potential for any type of impact. This includes physical, financial or any other impact, such as:

• inability to exercise rights (including data protection rights);
• loss of control over the use of personal data; or
• any social or economic disadvantage.

As you can see from the above finding someone for “personal reasons” will not justify the three-part test. The request will not satisfy the legitimate interest, the necessity test and balancing test between the justification and the individual’s interests, rights or freedoms.

Example

• A parent trying to locate their adult son that moved away and cut ties could satisfy the purpose and necessity test but it may not satisfy the balancing test. Therefore, the private investigator will have reasonable ground to take the instruction and conduct the trace but it will be required for the subject consent to disclose their address. The consent is necessary because the subject “interests, rights or freedoms” could be negatively affected and the risk to individuals’ rights and freedoms is about the potential for any type of impact. This includes physical, financial or any other impact, such as:
  • inability to exercise rights (including data protection rights);
  • loss of control over the use of personal data; or
  • any social or economic disadvantage.

“Furthermore, the interests of the individual could override your legitimate interests if you intend to process personal data in ways the individual does not reasonably expect. This is because if processing is unexpected, individuals lose control over the use of their data, and may not be in an informed position to exercise their rights.

Also, if you don’t have a pre-existing relationship, it is harder to demonstrate that the processing can be reasonably expected.”

 

Adapted from  Source: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-is-the-legitimate-interests-basis/

Why is consent important?

Consent is one lawful basis for processing, and explicit consent can also legitimise use of special category data. Consent may also be relevant where the individual has exercised their right to restriction, and explicit consent can legitimise automated decision-making and overseas transfers of data.

What is valid consent?

Consent must be freely given; this means giving people genuine ongoing choice and control over how you use their data.

Consent should be obvious and require a positive action to opt in. Consent requests must be prominent, unbundled from other terms and conditions, concise and easy to understand, and user-friendly.

Consent must specifically cover the controller’s name, the purposes of the processing and the types of processing activity.

Explicit consent must be expressly confirmed in words, rather than by any other positive action.

Source: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/

Conclusion

It is not straightforward to know what is and what doesn’t constitutes a legitimate reason. This is why we recommend that our clients contact us as soon as possible to discuss their specific case details with a qualified private investigator because of we asses each matter on its own merits.

With private investigations each case is unique and here at Bravo Investigations, we aim to help everyone solve their problems quickly and efficiently.

Contact our office today for a FREE no obligation discussion in complete confidence and discretion.