Законный интерес как универсальное основание для обработки персональных данных без согласия субъекта: проблемы правоприменительной практики

Закон. 2025. № 9. С. 16–33.

Savelyev A.

The paper is focused on legitimate interest of the data controller as an independent basis for processing personal data without the data subject's consent, which currently remains underestimated in Russian case law despite its significant potential. The author argues that legitimate interest can become a flexible and universal tool for legitimizing the processing of personal data, especially in the context of the crisis of the consent-based model for personal data processing. The article examines the conditions for applying this basis (the concept of legitimate interest, criteria for the necessity of processing, and the non-violation of the rights and legitimate interests of the subject) taking into account existing case law and guidance from Roskomnadzor.

To enhance the effectiveness and universality of applying legitimate interest, the article proposes a clear distinction between this basis and other grounds for processing, such as the performance of an data controller's functions and obligations. As key criteria for ensuring the protection of the rights and legitimate interests of data subjects, it is suggested to consider their reasonable expectations and ensure data confidentiality. To prevent abuse associated with the use of legitimate interest, it is proposed to emphasize its subsidiary nature, whereby it cannot be used to bypass existing, more specific grounds for processing. Additionally, the article substantiates the need to limit its application exclusively to private data controllers, excluding its use by state and municipal authorities.

Keywords: legitimate interests, законный интерес, consent to personal data processing, согласие на обработку персональных данных