one of the interesting realities of the
60 some-odd page opinion around
legitimate used legitimate purpose was a
very positive I thought discussion of
the fact that there are times where
benefits or legitimate interest of a
business or controller can be considered
quite significant perhaps even though
you don't have some of the other basis
for for processing presumably consent or
other issues should I not get too
excited Yakko that this is some
increased appreciation from data
regulators for a benefit and risk
approach and with sort of that backdrop
how does that opinion or sort of your
concerns about this effort to shift
focus clashes with some of the basic
concerns or is it compatible and and are
we simply talking about messaging are we
simply to look to sort of Peters comment
that we're not changing anything here
we're saying we all jump up and down
about a couple of the phrases and say
this is you know the primary basis let's
breathe more life into principles that
are there but seem to have been getting
short shrift the article given us some
positive look that supports the the
model that we've heard about today what
are your thoughts well difficult after
after so many thoughts that pass to do
too so may I may I just jump to
the the fear that I have having a look
at the work that has been done and and
still is being done by Brianna and and
and Richard is the fear that I got when
I visited Silicon Valley okay I was
there with Peter Hastings and people
looked at me as as their grand
grandfather because they were all but
the end very short they said it's
interesting what you're saying but our
business model is against it now if
that's the key point in what these
gentlemen are doing that I'm against it
because the principle based approach of
privacy and I'm not going to go through
these principles right now would be too
time-consuming and I'm not sure whether
I would be complete and need some 34,000
Shakespeare words in on earth over it
but the principle based approach of the
European our regulation anyway and
directive is one that is very forceful
and and stood the test of time pretty
well I would think there's a couple of
things that we must change absolutely
but not get rid of these principles now
there's one misunderstanding reading the
the the the several pieces of paper that
were much shorter than our legitimate
interest opinion by the way but come
close to it is that the that that the
the notice and choice model in fact is a
very US based model not talking too much
about fundamental rights and stuff like
that
we have you need a legal ground and come
to work with data anyway and and the
consent is only one of them and not even
the most important one long legal
notices will most likely not even lead
to valid consent as far as the European
legislation is concerned so I'm fully
with all of you saying that we have to
shift responsibility because who the
hell as normal citizen would understand
what he's saying yes to I mean this
technology behind all this is too
complicated to to grasp and so that
accountability comes in a risk
assessment comes in is is is a very good
is excellent and his working party
starting the discussion on the lid on
the new regulation we embraced the
risk-based approach not only because in
the directive there's four or five
articles that already hint towards that
risk-based approach so it's not it's not
completely new so I could say more about
that but let me let me end up with two
remarks the vs yes our legitimate
interest opinion is not very short and
and maybe not too easy to read my advice
to avoid on and monday was just read the
last 67 pages and and you got the
essence and and I think all of you
should read it because legitimate
interest until now hasn't been used that
much because it's a balancing test where
you need to balance the interest of the
company to its the
until right of the citizens and a
balancing test generally isn't a one
size fits all fits old decision a
balancing test requires everyone to
think a little bit and generally in life
people are very much against that so
that's why I think that legitimate
interest isn't used very much in it it
might be very helpful in the discussion
to take on board that part because it is
really what we think is the best way of
thinking right now there's six legal
grounds one of them being legitimate
interest I'd have a look at it because
then probably things like risks even
somewhat more looking at the use and and
and maybe less at the collection and
sexual though I'm very much doubtful if
if we go that way it might be a slippery
slope that when the end we're only
looking at use and not you looking at
collection anymore collection once it is
collected and there's always a guy or a
woman who will think we can use it for a
complete other direction and so
collection is still if if it's going to
be a fundamental right collection is
also falls on it and finally and come
back to my first remark if it is if this
all thinking is because the middle the
business model doesn't fit into the
regulation or into the principles of
data protection then then I'll stay very
ceptable about the outcome