This legitimate interests assessment (LIA) template is designed to help you to decide whether or not the legitimate interests basis is likely to apply to your processing. It should be used alongside our legitimate interests guidance.

Part 1: Purpose test

You need to assess whether there is a legitimate interest behind the processing.

• Why do you want to process the data?
• What benefit do you expect to get from the processing?
• Do any third parties benefit from the processing?
• Are there any wider public benefits to the processing?
• How important are the benefits that you have identified?
• What would the impact be if you couldn’t go ahead with the processing?
• Are you complying with any specific data protection rules thatapply to your processing (egprofiling requirements, or e-privacy legislation)?
• Are you complying with other relevant laws?
• Are you complying with industry guidelines or codes of practice?
• Are there any other ethical issues with the processing?

1) Journalist/Influencer Data

The purpose of data processing is to maintain an up to date and relevant database of journalists, bloggers, agents and other media influencers, so the agency may contact them with relevant information. This is the core part of an activity known as ‘media relations’.

The agency benefits by using this data to share relevant information and content with the data subjects in order to gain media coverage for the agency’s clients.

There are wider public benefits. The agency helps to keep journalists, bloggers, agents and media influencers informed of what is going on in their industry. The agency also helps clients, small and large, have access to the media. Access to the media is an important part of a well-functioning democracy.

These benefits are commercially vital for the agency as it enables it to do the media relations work that its client have engaged it to do deliver. It also also beneficial for the data subjects, as it provides them with useful information, content and ideas to help them to do their jobs.

2) Customer data

In certain circumstances, the agency is required to process personal customer data on behalf of the agency’s clients, as part of competitions, giveaways and other consumer-facing promotions. This is necessary in order to ensure that the entrants receive the prizes or benefits they are entitled to. If we couldn’t handle their data, they wouldn’t be able to benefit from the competition or promotion. The agency does not store any data collected as part of competitions or promotions, and simply transfers the data from the winner to the client.

In all communications, the agency abides by the CIPR Code of Conduct.

In both circumstances, data will not be used in any unethical or unlawful way.

Part 2: Necessity test

You need to assess whether the processing is necessary for the purpose you have identified.

• Will this processing actually help you achieve your purpose?
• Is the processing proportionate to that purpose?
• Can you achieve the same purpose without the processing?
• Can you achieve the same purpose by processing less data, or by processing the data in another more obvious or less intrusive way?

This processing helps us to achieve our purpose and is reasonable and proportionate.

The same purposes could not be achieved without the processing. There is no practical way of achieving the purpose in another way.

Part 3: Balancing test

You need to consider the impact on individuals’ interests and rights and freedoms and assess whether this overrides your legitimate interests.

First,use the DPIA screening checklist.If you hit any of the triggers on that checklist you need to conduct a DPIA instead to assess risks in more detail.

Nature of the personal data

• Is it special category data or criminal offence data?
• Is it data which people are likely to consider particularly ‘private’?
• Are you processing children’s data or data relating to other vulnerable people?
• Is the data about people in their personal or professional capacity?

It is not special category or criminal offence data and the data is not likely to be considered particularly ‘private’.

We are not processing children’s data.

The vast majority of data is about people in their professional capacity. The only exception to this is when data relates to a competition or promotion which has been run on behalf of a client, in which case the data may be in their personal capacity.

Reasonable expectations

• Do you have an existing relationship with the individual?
• What’s the nature of the relationship and how have you used data in the past?
• Did you collect the data directly from the individual? What did you tell them at the time?
• If you obtained the data from a third party, what did they tell the individuals about reuse by third parties for other purposes and does this cover you?
• How long ago did you collect the data? Are there any changes in technology or context since then that would affect expectations?
• Is your intended purpose and method widely understood?
• Are you intending to do anything new or innovative?
• Do you have any evidence about expectations–eg from market research, focus groups or other forms of consultation?
• Are there any other factors in the particular circumstances that mean they would or would not expect the processing?

In many cases an existing relationship exists between us and individual data subjects.

Journalists and other influencers expect their details to be processed by PR agencies and the purpose is widely understood. This practice is known as ‘media relations’ and has been common for many years. Nothing has changed in technology or context that would affect this expectation.

Data is kept up-to-date and third-party sources are GDPR compliant. They have also notified data subjects that their data will be shared with the agency.

In the case of data from competitions and promotions being handled on behalf of agency clients, the data owners are aware that their information will be used to process their entry application. The competition or promotion clearly states that in order to enter, they must provide certain personal information. By entering the competition, the client has made sure that they are aware of why the data is being collected and have given consent for their information to be processed as part of the specific competition or promotion.

Likely impact

• What are the possible impacts of the processing on people?
• Will individuals lose any control over the use of their personal data?
• What is the likelihood and severity of any potential impact?
• Are some people likely to object to the processing or find it intrusive?
• Would you be happy to explain the processing to individuals?

Data subjects are likely to receive communications from the agency via email, telephone, social media and WhatsApp from members of the agency’s team.

The impact can be beneficial when communications from PR professionals are appropriate to the topics the data subjects cover. Potentially distracting when communications are not relevant.

Some people may object very occasionally, usually if the information provide by the agency turns out to be not relevant to a particular individual at a given time.

We would always be happy to explain our processing to individuals.

To minimise impact, we can ensure that data is kept up-to-date and our team makes reasonable efforts to send only relevant information and content to data subjects.

Can you offer individuals an opt-out? &nbsp &nbsp &nbsp &nbsp Yes / No

Making the decision

This is where you use your answers to Parts 1, 2 and 3 to decide whether or not you can apply the legitimate interests basis.

Can you rely on legitimate interests for this processing? &nbsp &nbsp &nbsp &nbsp &nbsp Yes / No

Do you have any comments to justify your answer? (optional)

Media Relations is a long standing and well-understood activity, with journalists, influencers, bloggers and agents understanding that agencies will contact them with information which is relevant to their industry. This is beneficial to all parties, with journalists receiving information to help do their job, agency’s can create media coverage which their clients have requested and clients are able to connect with the media in ways they are not able to do directly. There is no other means to achieving these combined without the agency processing their data and it will not be used unethically or illegally. Therefore, it is deemed appropriate that the agency can rely on legitimate interests in relation to their data processing.

LIA completed by : Jenna Owen, MD, Media Jems Limited

Date : 17.5.18

What’s next?

Keep a record of this LIA, and keep it under review.

Do a DPIA if necessary.

Include details of your purposes and lawful basis for processing in your privacy information, including an outline of your legitimate interests.