Rättslig grund för behandling av personuppgifter vid direktmarknadsföring

Sammanfattning: Personal data has an inherent commercial value and can be seen as an asset that generates revenue and competitive advantages. It is important that individuals receive the necessary protection for their personal data so that it is not used or processed in ways that are not legally compatible. The General Data Protection Regulation (GDPR) creates protection for individuals by informing organizations how personal data shall be processed in ways that do not conflict with the fundamental rights and freedoms of individuals. The processing of personal data must be supported in accordance with one of the six lawful grounds contained in Article 6) GDPR. This essay focuses on how processing of personal data for direct marketing can be supported in Article 6(1)(f) GDPR. In this article it is mentioned that personal data may be processed if it is necessary for the aim of the legitimate interests pursued by the controller or by a third party, except when such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Which interests that can be considered legitimate has not yet been established. An in-depth assessment must be made in each individual case where the interests of the parties are weighed against each other in a balancing test. This thesis exemplifies that it is not always easy to get an answer on whether or not the processing of personal data is covered by a legitimate interest in using the data for direct marketing. Consequently, individuals are at risk of having their personal integrity reduced.