The Ninja Sensei’s Logbook: The Legitimacy of the Legitimate Interests Exception

Organisations are generally required to secure first the consent of individuals before they can collect, use, and disclose their personal data, otherwise they will be liable under the PDPA.

However, this is not always the case! There is an exception to this rule called the Legitimate Interests Exception.

Under the Legitimate Interests Exception, an organisation may collect, use, and disclose personal data even without consent where it is in the legitimate interests of the organisation. This can be found under Part 3 of the First Schedule to the PDPA, and is subject to certain requirements such as:

✅It is in the organisation’s or another person’s legitimate interests to do so; and

✅the organisation’s or other person’s legitimate interests outweigh any adverse effect on the individual.

But wait!

Before an organisation can use the legitimate interests exception, it must first do an assessment, such as a DPIA, that meets the requirements. In terms of the DPIA, the organisation must be able to:

✔️identify and clearly explain the situation or purpose that qualifies as a legitimate interest;

✔️identify and put into place reasonable steps to eliminate, reduce the likelihood of, or lessen the negative effects of the processing of personal data on the individual; and

✔️follow any requirements that have been set.

Moreover, it is important to remember that an organisation that uses the legitimate interests exception to collect, use, or disclose personal information without getting consent must still take reasonable steps to let the subject individual know that the organisation is using the legitimate interests exception.

P.S. Got questions or do you need help with your cybersecurity and data protection compliance journey? Don’t hesitate to reach out to your friendly cybersecurity and data protection experts at Privacy Ninja. We are always a text/call or email away!

📱 WhatsApp: +65 8750 4250

📧 email: ninjas@privacy.com.sg

This post first appeared on Andy’s LinkedIn wall. Follow us on the following pages for more updates! Facebook | Twitter | LinkedIn | YouTube | Website