based on the vital interest of another natural person should in principle take place only where the processing
cannot be manifestly based on another legal basis. Some types of processing may serve both important grounds
of public interest and the vital interests of the data subject as for instance when processing is necessary for
humanitarian purposes, including for monitoring epidemics and their spread or in situations of humanitarian
emergencies, in particular in situations of natural and man-made disasters.
(47) The legitimate interests of a controller, including those of a controller to which the personal data may be
disclosed, or of a third party, may provide a legal basis for processing, provided that the interests or the
fundamental rights and freedoms of the data subject are not overriding, taking into consideration the reasonable
expectations of data subjects based on their relationship with the controller. Such legitimate interest could exist
for example where there is a relevant and appropriate relationship between the data subject and the controller in
situations such as where the data subject is a client or in the service of the controller. At any rate the existence of
a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the
time and in the context of the collection of the personal data that processing for that purpose may take place.
The interests and fundamental rights of the data subject could in particular override the interest of the data
controller where personal data are processed in circumstances where data subjects do not reasonably expect
further processing. Given that it is for the legislator to provide by law for the legal basis for public authorities to
process personal data, that legal basis should not apply to the processing by public authorities in the
performance of their tasks. The processing of personal data strictly necessary for the purposes of preventing
fraud also constitutes a legitimate interest of the data controller concerned. The processing of personal data for
direct marketing purposes may be regarded as carried out for a legitimate interest.
(48) Controllers that are part of a group of undertakings or institutions affiliated to a central body may have a
legitimate interest in transmitting personal data within the group of undertakings for internal administrative
purposes, including the processing of clients' or employees' personal data. The general principles for the transfer
of personal data, within a group of undertakings, to an undertaking located in a third country remain unaffected.
(49) The processing of personal data to the extent strictly necessary and proportionate for the purposes of ensuring
network and information security, i.e. the ability of a network or an information system to resist, at a given level
of confidence, accidental events or unlawful or malicious actions that compromise the availability, authenticity,
integrity and confidentiality of stored or transmitted personal data, and the security of the related services offered
by, or accessible via, those networks and systems, by public authorities, by computer emergency response teams
(CERTs), computer security incident response teams (CSIRTs), by providers of electronic communications
networks and services and by providers of security technologies and services, constitutes a legitimate interest of
the data controller concerned. This could, for example, include preventing unauthorised access to electronic
communications networks and malicious code distribution and stopping ‘denial of service’ attacks and damage to
computer and electronic communication systems.
(50) The processing of personal data for purposes other than those for which the personal data were initially collected
should be allowed only where the processing is compatible with the purposes for which the personal data were
initially collected. In such a case, no legal basis separate from that which allowed the collection of the personal
data is required. If the processing is necessary for the performance of a task carried out in the public interest or
in the exercise of official authority vested in the controller, Union or Member State law may determine and
specify the tasks and purposes for which the further processing should be regarded as compatible and lawful.
Further processing for archiving purposes in the public interest, scientific or historical research purposes or
statistical purposes should be considered to be compatible lawful processing operations. The legal basis provided
by Union or Member State law for the processing of personal data may also provide a legal basis for further
processing. In order to ascertain whether a purpose of further processing is compatible with the purpose for
which the personal data are initially collected, the controller, after having met all the requirements for the
lawfulness of the original processing, should take into account, inter alia: any link between those purposes and
the purposes of the intended further processing; the context in which the personal data have been collected, in
particular the reasonable expectations of data subjects based on their relationship with the controller as to their
Comments