f) legitimate interests
4 preliminary rulingsJudgment of 9 Jan 2025, C-394/23 (Mousse) 
Points (b) and (f) of the first subparagraph of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 5(1)(c) of that regulation, must be interpreted as meaning that – the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, does not appear to be either objectively indispensable or essential to enable the proper performance of a contract and, therefore, cannot be regarded as necessary for the performance of that contract; – the processing of personal data relating to the title of the customers of a transport undertaking, the purpose of which is to personalise the commercial communication based on their gender identity, cannot be regarded as necessary for the purposes of the legitimate interests pursued by the controller or by a third party, where: – those customers were not informed of the legitimate interest pursued when those data were collected; or – that processing is not carried out only in so far as is strictly necessary for the attainment of that legitimate interest; or – in the light of all the relevant circumstances, the fundamental freedoms and rights of those customers can prevail over that legitimate interest, in particular because of a risk of discrimination on grounds of gender identity.
Point (f) of the first subparagraph of Article 6(1) of Regulation 2016/679 must be interpreted as meaning that, in order to assess the need for processing of personal data under that provision, it is not necessary to take into consideration the possible existence of a right of the data subject to object, under Article 21 of that regulation.
Judgment of 17 Jun 2021, C-597/19 (M.I.C.M. Mircom International Content Management & Consulting)
Point (f) of subparagraph 1 of Article 6(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), read in conjunction with Article 15(1) of Directive 2002/58/EC of the European Parliament and of the Council of 12 July 2002 concerning the processing of personal data and the protection of privacy in the electronic communications sector (Directive on privacy and electronic communications), as amended by Directive 2009/136/EC of the European Parliament and of the Council of 25 November 2009, must be interpreted as meaning that it precludes in principle, neither the systematic recording, by the holder of intellectual property rights as well as by a third party on his or her behalf, of IP addresses of users of peer-to-peer networks whose internet connections have allegedly been used in infringing activities, nor the communication of the names and of the postal addresses of those users to that rightholder or to a third party in order to enable it to bring a claim for damages before a civil court for prejudice allegedly caused by those users, provided, however, that the initiatives and requests to that effect of that rightholder or of such a third party are justified, proportionate and not abusive and have their legal basis in a national legislative measure, within the meaning of Article 15(1) of Directive 2002/58, which limits the scope of the rules laid down in Articles 5 and 6 of that directive, as amended.
Judgment of 11 Dec 2019, C-708/18 (Asociaţia de Proprietari bloc M5A-ScaraA)
Article 6(1)(c) and Article 7(f) of Directive 95/46/EC of the European Parliament and of the Council of 24 October 1995 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, read in the light of Articles 7 and 8 of the Charter of Fundamental Rights of the European Union, must be interpreted as not precluding national provisions which authorise the installation of a video surveillance system, such as the system at issue in the main proceedings, installed in the common parts of a residential building, for the purposes of pursuing legitimate interests of ensuring the safety and protection of individuals and property, without the consent of the data subjects, if the processing of personal data carried out by means of the video surveillance system at issue fulfils the conditions laid down in Article 7(f), which it is for the referring court to determine.
Judgment of 19 Oct 2016, C-582/14 (Breyer)
Article 7(f) of Directive 95/46 must be interpreted as precluding the legislation of a Member State, pursuant to which an online media services provider may collect and use personal data relating to a user of those services, without his consent, only in so far as that the collection and use of that data are necessary to facilitate and charge for the specific use of those services by that user, even though the objective aiming to ensure the general operability of those services may justify the use of those data after a consultation period of those websites.
Disclaimer