Legitimate Interests Game

The objective of this game is to bring to practice, in a fun way, reflections on the application of the lawful basis of legitimate interest. Concrete cases help us think about different aspects that should be taken into account when mobilizing this lawful basis for the processing of personal data. They are a starting point; you can and should expand on these reflections from your own experiences. The analyses and thermometers for each area are a proposal for generalization that does not aim to state whether a case ‘passes the test’ or not, but rather to indicate some points that should be looked at more carefully.
Check out the instructions for each part of the game below!

The theme refers to circumstances, relationships or activities that are relevant to the analysis of the applicability of legitimate interests as a lawful basis for processing personal data (ex: labor relations, marketing, analytics). In this game, for each theme card there is a greater or lesser number of concrete cases that exemplify that section.

Cases represent concrete situations. Although hypothetical, they are mostly based on real events discussed by Authorities that analyzed the applicability of legitimate interests as a lawful ground for processing data. In this type of card, the reader will come across narratives in which the characters analyze the feasibility of carrying out data processing based on legitimate interests and, also, the measures to be taken to ensure compliance with the legal requirements. Throughout the descriptions, there are indications of “phases”, corresponding to the 4 (four) phases of the Legitimate Interest Assessment (LIA): legitimacy (phase 1), necessity (phase 2), balancing (phase 3) and safeguards (phase 4).

For each theme, there is a general analysis on the criticality of each of the 4 (four) phases of the Legitimate Interest Assessment. With this, the cards indicate certain patterns and point out which of the 4 stages of LIA presents a higher level of sensitivity. Despite proposing a generalization and attributing sensitivity levels to the phases, the analysis cards do not intend to state that a certain case will ‘’pass’’ or not “pass” a Legitimate Interest Assessment, its purpose is to alert about possible points of attention.

Based on the level of sensitivity identified in the analysis cards, the thermometer serves as an overview and as an illustration of the points of attention of the LIA phases for each theme. The thermometer uses colors that measure the “temperature” (degree of sensitivity) of the legitimate interest assessment for that theme: (i) red: high; (i) yellow: median and; (iii) green: low. Here, it is again worth noting that the thermometer is not intended to state whether or not a case “passes” the Legitimate Interest Assessment, but rather to indicate which points deserve greater attention by data processors, controllers and authorities on a particular sector.