The Concept of the “Legitimate Interest of the Data Controller” in the Context of the Personal Data Protection Board's Decision Published on 16 April 2019

Assoc. Prof. Dr. Murat Volkan Dülger^*

The decision published by the Personal Data Protection Board on 16 April 2019 concerns the legitimate interest of the controller. The decision was given upon an application made to the Authority by a controller requesting to use, within the framework of legitimate interest, personal data which it processes in order to fulfil its statutory obligation. It should be noted that two different conditions for processing are at issue here: the controller processes personal data “in order to be able to fulfil its legal obligation”, or, although the processing activity specific to the existing purpose has come to an end, it wishes to go on using, within the framework of its “legitimate interest”, the personal data which it wishes to continue to process. It has also notified the Board of its request to that effect.

Because of the importance and scope of the conditions for processing that are the subject of the decision, I shall first explain the exceptions in question and the contentious points concerning them, and then try to assess the Board’s decision. In this context I shall deal in particular with the additional rules which the Board has introduced by its decision, and underline the points on which controllers need to be careful. I shall also refer, where appropriate, to the Constitutional Court’s judgment of 28 September 2017, No. 2016/125 E. and 2017/143 K.¹, in which both of the exceptions mentioned in the Board’s decision were addressed².

1. Subject matter of Decision No. 2019/78 of 25/03/2019 on the processing of personal data by the controller within the framework of its statutory obligation and its legitimate interest

In the case at hand, a company operating as a “Fuel Distribution Company” stated that, under the relevant legislation and decisions, it was under an obligation to set up a monitoring system and that the processing of vehicle owners’ personal data was necessary in order to set up that system, and it requested to process data without explicit consent for the protection of its legitimate interests.

Accordingly, the company, which operates under the Petroleum Market Law No. 5015, has, within the framework of the obligation imposed by a Decision of the Energy Market Regulatory Board, set up a system which shows sales transactions (number plate, type of fuel, quantity, price, and time in hours, minutes and seconds), permits queries and is also open to real-time access by the relevant Authority. The company wishes to use the “Vehicle Recognition Project”, developed because the data on number plates and fuel type contained in this system lead to incorrect refuelling in the sector. With this project, fuel and number-plate data are matched automatically and purchases of the wrong fuel are prevented.

The controller company stated that it has to use the consumer’s vehicle number plate for this system, which it will use in order to prevent incorrect refuelling, and that its legitimate interests would thereby be protected; on that ground it applied to the Authority with a request to use, within the scope of the project in question, certain data which it processes under the automation system, without the explicit consent of the data subject.

2. Processing being necessary for the controller to be able to fulfil its legal obligation

Pursuant to Art. 5(2)(ç) of the Law, the article being entitled “Conditions for processing personal data”, if the controller has to process personal data in order to be able to discharge a responsibility imposed on it by the laws, it may carry out that processing without obtaining the explicit consent of the data subject. In this case, although the laws do not expressly lay down for which specific purpose and for how long the controller will store personal data, the obligation which the controller must fulfil has been laid down in either general or specific form.

This exception was criticised on the ground that the concept of the processing of personal data being “necessary” for the controller is vague and that it would dispense with the need to obtain the explicit consent of the data subject, and it became the subject of the Constitutional Court judgment mentioned above. While accepting that this rule restricts the protection of personal data, the Court reached the conclusion that this had been done in conformity with the principle of proportionality, as required by the concept of public interest, and had been confined to cases of necessity, and it dismissed the application for annulment.

To begin with, it is clear that the exception in question is uncertain as to the situations in which the controller is under such a necessity and, consequently, the situations in which it may process data. At the same time, it is not possible for the many different lawful processing activities that may be carried out on this basis to be listed one by one in a statutory provision. For this reason, while I consider this ground of lawfulness appropriate, pursuing as it does the aims of not making it harder for controllers to fulfil their obligations and of sparing them the problems they would face in practice if they constantly had to obtain explicit consent, I also think that the points of uncertainty must be clarified by the Board’s publications and decisions.

In my opinion, the exception in question should be applied in situations which do not fall under the legal ground that the processing of personal data is “expressly provided for by the laws” but which nevertheless place controllers under a statutory obligation. The case of necessity for a legal obligation denotes the processing activities that are necessary for obligations to be fulfilled where there is no processing activity expressly provided for by the laws.

Looking at the concrete case, a decision of the Energy Market Regulatory Authority (EPDK) has imposed on controllers an obligation ensuring that dealers’ sales transactions are displayed, and under this obligation controllers have to process personal data. From this point of view, therefore, the controllers concerned are obliged to process data in order to fulfil their legal obligations imposed by the EPDK decision, and there is no doubt whatsoever on this point.

3. Processing being necessary for the “legitimate interests” of the controller

Art. 5(2)(f) of the Law, the article being entitled “Conditions for processing personal data”, lays down as a condition for processing that processing is necessary for the legitimate interests of the controller, provided that it does not harm the fundamental rights and freedoms of the data subject. Accordingly, where the controller has to process personal data for its legitimate interests, it may carry out that processing activity without obtaining the explicit consent of the data subject, on condition that the fundamental rights and freedoms of the data subject are not harmed.

This exception harbours more controversy than the case of the controller’s legal obligation dealt with under the previous heading. The main reason for this is that it is unclear what is to be understood by the concept of the controller’s legitimate interest. Indeed, the annulment of this ground of lawfulness, too, was sought in the Constitutional Court judgment referred to. The concern was voiced that this vagueness would lead to the concept being interpreted so broadly as to be capable of harming the data subject’s right to the protection of personal data, and that explicit consent would no longer be needed.

In some situations, however, the interest and benefit which the controller will obtain from the processing activity it carries out may allow the data to be processed without harming the fundamental rights and freedoms of the data subject. What needs to be done, then, is not to bar processing within the controller’s legitimate interest by rigid lines, but to find a reasonable balance between the controller and the data subject (the balancing test). Otherwise we would be faced with a situation that cannot go beyond theory and makes practice more difficult instead of easing it, and that is not a realistic outlook in keeping with the ordinary course of life.

Indeed, the Constitutional Court, too, takes the view that the exception in question does not relate to every kind of data of a person, that it can come into play only where certain conditions are present, and that there is no question of the exceptions being turned into the main rule³. Stating that this rule was introduced in order to prevent losses of rights and interests, it underlined that the avenues of complaint and application are in any event open in the event of its breach or abuse. The Court explained that the concept of legitimate interest must be understood as “a balance which needs to be assessed within the framework of having regard to the interest of the controller and that of the data subject”; stating that the rule contains no unlawfulness and that what matters is how this balance is to be struck, it dismissed the request for annulment.

In my opinion, the cases in which a legitimate interest will or will not be accepted as existing must be clearly determined. This would both bring great ease in practice and deprive of any validity a claim, resting on subjective criteria, that a legitimate interest exists.

I think that the Board decision I am examining is highly important precisely at this point. Before the decision, the processing of personal data on the basis of the controller’s legitimate interest was not subject to specific and comprehensive conditions. The Law laid down the condition of not harming the fundamental rights and freedoms of the data subject, while the guidelines published by the Board on the subject spoke of the interest and benefit of the controller and of the legitimate interest being effective, specific and already existing⁴. With the decision, however, a number of additional conditions have been laid down, in an attempt to ensure that the processing of personal data on the basis of the concept of legitimate interest is interpreted narrowly.

When the Law, the guidelines and the Board decision in question are taken together, a controller, in order to process personal data on the basis of the concept of legitimate interest, must examine whether the following are present:

• that the interest to be obtained as a result of the processing of the personal data is capable of competing with the fundamental rights and freedoms of the data subject,

• that the processing of personal data is necessary in order to attain the interest in question,

• that the legitimate interest is already existing, specific and clear,

• that a benefit will be gained if the legitimate interest, which is capable of competing with the fundamental rights and freedoms of the data subject, is obtained, and that it is not possible for this benefit to be brought about by any other way or method without processing personal data,

• that, in determining the legitimate interest, criteria of a transparent and accountable nature are taken as the basis, such as that the benefit in question affects a large number of persons, that it is not directed solely at making a profit or securing an economic benefit, and that it facilitates business processes or an operation (for example, not at the level of one unit or a small number of staff, but in a way that affects the organisation as a whole),

• that, in this respect, the data subject is kept away from every foreseeable, clear and imminent danger, in order to prevent harm to his or her fundamental rights and freedoms, above all the protection of his or her personal data,

• that every technical and administrative measure is taken to ensure that personal data are processed lawfully in a data filing system, limited to the purpose, and to prevent harm and breaches,

• that compliance with the general principles is ensured in the processing of personal data,

• that, in this context, the balancing test is carried out by comparing the fundamental rights and freedoms of the person with the legitimate interest of the controller.

I must point out that the fact that the Board, by its decision, has laid down numerous conditions, as listed above, for controllers to be able to process personal data on the basis of the concept of legitimate interest is important, particularly because it is capable of settling the debates concerning legitimate interest. What is understood in general terms from these conditions is:

• that the concept of legitimate interest must be interpreted narrowly,

• that it is provided for only in cases of necessity, and

• that it must in no way produce a result to the detriment of the data subject.

However, although the Board has thus made the processing of personal data on the basis of legitimate interest subject to strict conditions, it did not, as I shall explain below, take these conditions sufficiently into account in its conclusion on the concrete case.

4. The decision

The Board regarded the automatic integration by the company concerned of the vehicle number-plate and fuel-type information of consumers already held in its records into the Vehicle Recognition Project system as a new personal data processing activity. Up to this point there is no problem. For although the personal data are already held within the company, transferring them to another system, albeit again within the same company, recording them or keeping them in that system is a new personal data processing activity. Consequently, the features that must be present and the obligations that must be fulfilled in order to process personal data have to be examined afresh here.

In the concrete case, the company concerned wishes to base this new personal data processing activity on the exception of “being necessary for its legitimate interest”. In its examination of this, the Board first gave an explanation regarding the damage occurring in the case. According to this, under Law No. 6502 on Consumer Protection, a distributor company such as the applicant company is jointly and severally liable, together with the operator company, for the damage suffered by consumers as a result of incorrect refuelling. This situation will lead to financial loss for both the consumer and the distributor company and also to losses in the company’s brand value and service quality.

In the examination it carried out within this framework, the Board reached the conclusion that the controller’s automatic integration into another system of the number-plate and fuel-type data of consumers already in its possession falls within the case set out in Art. 5(2)(f) of the Law, namely that “processing is necessary for the legitimate interests of the controller, provided that it does not harm the fundamental rights and freedoms of the data subject”. Accordingly, it was decided that the company concerned need not obtain the explicit consent of the data subjects, provided that it fulfils the obligation to inform in an accessible and visible manner and does not use the data in question for any other purpose.

5. Assessment of the decision

I must first state that it is not possible to regard the Board’s decision as lawful without hesitation. Particularly when one considers the number of persons whom the decision will affect, I think that a decision open to debate has been given. The main reason for this is the scope of the fundamental principles relating to the processing of personal data and of the grounds of lawfulness for processing.

a. The principle of “processing for specified, explicit and legitimate purposes”

The principle requires the objectives which the controller seeks to achieve in processing personal data to be specified, explicit and legitimate. It thereby makes it possible to determine which data will be processed for which purposes. By its nature, the principle comprises two distinct stages: the process of collecting personal data for specified, explicit and legitimate purposes and, thereafter, processing in conformity with the collection purposes so determined. The basic point to be discussed here is the requirement of processing in conformity with the purposes of collection.

I must point out that this principle has not absolutely prohibited processing for a purpose other than the one that was determined and declared. The provisions of the GDPR show that personal data collected for a specified, explicit and legitimate purpose may also be processed outside that purpose, but only for a purpose “compatible” with it. Consequently, where the different purpose that arises subsequently is compatible with the initial purpose, the personal data processing activity may be regarded as lawful. By contrast, the Law contains no express provision on this matter, and indeed, when the provision of the Law and the guidelines published by the Board are taken into account, the implication is that processing will not be permitted even where the different purpose is compatible. Indeed, I underlined the need for this point to be clarified in my book on the subject as well⁵.

The fundamental principles relating to the protection of personal data contain absolute obligations that must be complied with in every kind of personal data processing activity, irrespective of any particular feature. Consequently, in the concrete case, the obligation to process in conformity with these principles continues even where the data subject’s explicit consent or any one of the conditions for processing is present. For while the conditions for processing personal data show in which cases the controller may process personal data, the fundamental principles contain the principles and procedures that must be observed throughout the entire process from the initial collection of the personal data to the end of the processing activity. For this reason, in order to be able to speak of lawful processing in the concrete case, an examination must be carried out in terms of the fundamental principles as well as the conditions for processing.

However, since our Law contains no provision similar to that in the GDPR which could create an exception to this fundamental principle, the principle must be applied in full. In this context, even if it is accepted that the processing activity is for a legitimate purpose, it is not possible to say that it is for a “specified” and “explicit” purpose. For the data subjects’ explicit consent on this matter was not obtained, nor were they informed about it.

b. Problem Areas

Returning to the present case, there is no doubt that the automatic integration of the data into another system rests on a purpose different from the initial one and is a new processing activity.

The following questions essentially arise here:

• Is the purpose that arose subsequently compatible with the initial purpose?

The processing of personal data within the framework of the obligation imposed by the EPDK decision serves the purpose of recording dealers’ sales transactions and making them accessible to the EPDK as well. The reason for this is to prevent the sale of smuggled fuel and unfair competition, and to keep under control the supply of and demand for energy, which is a public need. The purpose of wishing to use in another project the data contained in the automation system set up for this, on the other hand, is to prevent incorrect refuelling. It is therefore highly debatable whether the two purposes are compatible. This should not be taken to mean that the parties have no legitimate interest in preventing incorrect refuelling. It is apparent, however, that there is no clear compatibility between the purpose for which the data were initially collected and the purpose of the subsequent processing.

• If it is concluded that it is compatible, may the processing activity be continued?

As I stated above, while the provisions of the GDPR accept the compatible purpose, in the Law this situation is not sufficiently clear. This is a matter that needs to be clarified; in my opinion, in line with the provisions of the GDPR, the path of accepting a different purpose that is compatible should be taken. For this, too, a legislative amendment is required.

• If it is not compatible, is the explicit consent of the data subject or the presence of any one of the conditions for processing required?

Where the purpose that arose subsequently is not compatible with the initial purpose, the situation is not open to interpretation. All the conditions that have to be present for the processing of personal data, above all the existence of the conditions for processing, the process of obtaining explicit consent and the obligation to inform, must be satisfied afresh. Consequently, the first thing to be examined is whether any one of the exceptions applies to the personal data.

• Can a legitimate interest of the controller be said to exist in the present case?

In fact, in the present situation the controllers, the processors and the data subjects all have a legitimate interest. The use of the correct fuel will prevent pecuniary damage and waste. Where, when first collecting the personal data or when beginning to process them for this purpose, the controllers inform the data subjects about this, a legitimate interest will exist. In my opinion, however, although the other principles set out in the decision are present, I do not think that the condition “that the processing of personal data is necessary in order to attain the interest in question” is fully met. In the concrete case it is clear that there is a legitimate interest and that the fundamental rights and freedoms of the data subjects are not harmed either, in short that the balance of interests is struck. Yet the processing of personal data is not necessary in order to reach the same result. To achieve this aim, the fuel distribution company will be able to prevent the damage from occurring by taking different measures. This shows that the element of necessity was relaxed in the Board’s decision.

In conclusion, I think that the example of the fuel distribution company may also hold true for many other sectors, that it is an extremely good example, that the Board has given a decision in keeping with commercial life and the ordinary course of life, and that it has done so by means of the purposive method of interpretation. Let us also say, however, that this interpretation sets out the law as it ought to be and does not fully satisfy the element of necessity under the existing statutory regulation. In this context, although the concept of necessity is an important element for narrowing the limits of legitimate interest, I am of the opinion that not interpreting the concept of necessity too narrowly, by way of purposive interpretation, is also an appropriate approach. Otherwise, I think we would be faced with the result that the limits of the concept of legitimate interest are narrowed more than necessary and its field of application is all but eliminated.