This LEGITIMATE INTERESTS ASSESSMENT (“LIA”) is designed to set out and explain the legal grounds under the GDPR on which SURFE relies when processing personal data as data controller (see Privacy Policy) in the context of providing B2B data services.
1. PURPOSE AND IDENTIFICATION OF THE LEGITIMATE INTEREST
1.1. As part of its services, SURFE processes professional contact data relating to individuals acting in a business capacity, including but not limited to names, professional email addresses, job titles, company affiliations and business telephone numbers.
1.2. This processing enables SURFE to deliver reliable, relevant and up-to-date B2B information to its customers, allowing them to identify and approach appropriate business contacts in a professional context.
1.3. The legitimate interest pursued by SURFE consists in operating and developing its B2B data services by facilitating targeted and efficient business communications, which contributes to the smooth functioning of commercial relationships within the B2B ecosystem.
2. NECESSITY OF THE PROCESSING
2.1. The processing of professional contact data is essential to the provision of SURFE’s services. Without such processing, SURFE would be unable to deliver the core functionalities expected by its customers, which would undermine both its contractual obligations and its economic activity.
2.2.Alternative means, such as obtaining individual prior consent from each data subject, would not constitute a realistic or proportionate solution in a B2B context, as they would significantly impair the effectiveness, accuracy and scope of the services offered.
3. BALANCING TEST
3.1. Nature of the data processed:
The data concerned is strictly limited to professional information used in a business environment. No special categories of personal data are processed, and the information involved is generally considered to be of low sensitivity.
3.2. Reasonable expectations of data subjects:
Individuals acting in a professional capacity can reasonably expect their business contact details to be used for legitimate B2B purposes. Such information is often made publicly available by the data subjects themselves or shared within professional databases.
3.3. Impact on Data Subjects:
The impact on privacy is limited, as the processing does not concern private life, confidential information or sensitive personal data. The use of the data remains strictly confined to professional contexts.
3.4. Safeguards and mitigating measures:
- A clear and easily accessible privacy policy published on SURFE’s website;
- Straightforward opt-out mechanisms (accessible on SURFE’s website) and efficient handling of data subject rights requests;
- Application of data minimization principles, ensuring only relevant professional data is processed;
- Regular training of employees on GDPR compliance and data protection obligations;
- Secure data management practices and limited data retention periods.
4. CONCLUSION
AFTER CAREFUL ASSESSMENT, SURFE CONSIDERS THAT THE LEGITIMATE INTERESTS IT PURSUES ARE NOT OVERRIDDEN BY THE INTERESTS OR FUNDAMENTAL RIGHTS AND FREEDOMS OF THE DATA SUBJECTS CONCERNED. THE PROCESSING CARRIED OUT IS PROPORTIONATE, NECESSARY AND ACCOMPANIED BY ADEQUATE SAFEGUARDS, AND THEREFORE JUSTIFIED ON THE BASIS OF LEGITIMATE INTEREST UNDER THE GDPR.
