8 GDPR provisions stipulate that the controller must weigh up the interests:

Art. 6 I f: “Processing shall be lawfull if it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject […].”

 

Art. 15 IV: „The right to obtain a copy referred to in paragraph 3 shall not adversely affect the rights and freedoms of others.”

Art. 17 I c: “The data subject shall have the right to […] erasure […] where the data subject objects to the processing pursuant to Article 21 (1) and there are no overriding legitimate grounds […].”

 

Art. 17 III: „Paragraphs 1 and 2 [right to erasure] shall not apply to the extent that processing is necessary […].”

 

Art. 18 I d: “The data subject shall have the right to […] restriction of processing where […] the data subject has objected to processing pursuant to Article 21 (1) pending the verification whether the legitimate grounds of the controller override those of the data subject.”

 

Art. 20 IV: “The right referred to in paragraph 1 [right to data portability] shall not adversely affect the rights and freedoms of others.”

 

Art. 21 I 2: “The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject […].”

 

Art. 49 I 2: “Where a transfer could not be based on a provision in Article 45 or 46, […] a transfer to a third country or an international organisation may take place only if the transfer […] is necessary for the purposes of compelling legitimate interests pursued by the controller which are not overridden by the interests or rights and freedoms of the data subject […].