Legitimate interest assessment

Legitimate interest assessment

V. n.2 of August 1, 2024

This page is managed by Adasta Media S.r.l., with registered offices at Milan (Italy), Viale Premuda, n.46, 20129, VAT No. 10128870960 (hereinafter, “Adasta Media”, “Us” or “We”), and it aims to show that the processing of data collected with cookies and/or other tracking tools used by Adasta Media, carried out by Us under our legitimate interest, is disclosed to data subjects and is based under a prior legitimate interests assessment, as required under “The Transparency Consent Framework (TCF)” of IAB Europe (hereinafter, “TCF”).

As a controller under the TCF, We are required to justify the processing of personal data carried out under legitimate interest for “Special Purpose 3 – Save and communicate privacy choices”. When assessing Adasta Media’s legitimate interest, the interests of Adasta Media as well as the interests of the publishers concerned and our advertisers (and their respective intermediaries if any) were considered. In particular, the table below summaries Adasta Media’s legitimate interest assessment.

Special Purpose Special Purpose 3 – Save and communicate privacy choices
PURPOSE TEST

Context of processing. Data subjects will receive notice of the processing and of the legal basis under which Adasta Media processes the preferences expressed by users, regarding the processing of data, based on the information the user has received through the Consent Management Platform (“CMP”) on the websites of publishers/advertisers (“Websites”). As required under the applicable law and the TCF, a balancing test was carried out by Adasta Media in which it was confirmed that the processing for Special Purpose 3 at stake carries no risk of undue negative impact on the data subjects’ interests or fundamental rights and freedoms.

Purpose of processing. The CJEU ruling in the case C‑604/22 (IAB Europe vs APD) establishes that the TC String may constitute personal data if it can be associated with other data points that may make it possible to identify the individual concerned and if Adasta Media S.r.l. has reasonable means allowing it to identify a particular natural person from a TC String, when associated with identifiable information. The saving and communicating of users’ privacy choices in the form of TC Strings in the context of the TCF is performed for the purpose of ensuring and being able to demonstrate that users have expressed a choice (such as, for example, consented to the processing of their personal data, for various purposes and/or vendors).

NECESSITY TEST

The intended processing is necessary and proportionate for the purpose explained above considering that Adasta Media, according to the GDPR (art. 6), as well as to the e-Privacy Directive as implemented in Italy (art. 122 Italian Privacy Code) and to the Italian Data Protection Authority’s Guidelines (“Guidelines on the use of cookies and other tracking tools – 10 June 2021”) is not allowed to process the data unless the users expressed its consent to store and/or access information on a device (according to “Purpose 1 – Store and/or access information on a device”) and Adasta Media is able to demonstrate to having obtained the said consent. It is also necessary that the user is not required to make choices any time he/she enters into a Website. There are no less intrusive alternatives that use less, or no, personal data as the use of personal data is necessary in order to prove that a user expressed a specific choice. The TC String contains only information that is strictly necessary to achieve the intended purpose of saving, communicating and observing users’ privacy choices.

BALANCING TEST

Taking into account the nature and purpose of the processing, it is possible to affirm that risks for data subjects to their rights and freedoms are very low. In particular, among the others, Adasta Media evaluates the following aspects:

  • Nature of the data: no special category of personal data or personal data relating to criminal convictions and offences is processed. Moreover TC String is a string of characters that represent an abstract user’s privacy choices without directly attributing these to any specific user;
  • Data subjects’ characteristics: Adasta Media does not voluntary collects data pertaining to vulnerable population (such as children).
  • Data subject’s reasonable expectations: a reasonable person would expect the processing in light of the fact that publishers are requiring them to express choices, also on behalf of Adasta Media, and both Adasta Media and publishers shall be able to prove to having register choices expressed. Moreover, users are informed about the processing through the CMPs’ user interfaces;
  • Likelihood of any risk: the TC String itself does not present any particular privacy risks for data subjects, as it merely reflects their privacy choices.

The “Right to Object” to Special Purpose 3 is not technically supported by the TCF. Adasta Media itself evaluates that the end users cannot execute the “Right to Object” to the legitimate interest because of the fact that:

  • it is necessary to ensure the appropriate recording of users’ privacy choices. If users’ choices are not recorded, users are required to express their choices any time they enter into the digital properties of the publisher (such an approach would moreover likely raise other issues, given that the users cannot be continuously solicitating to express their choices, according to the EDPB and the Italian Data Protection Authority’s guidelines);
  • the processing of users’ privacy choices is necessary according to art. 5 and 6 GDPR as well as art. 122 Italian Privacy Code. Information must be stored in relation to users’ privacy choices in order to respect them, irrespective of which choices precisely the user makes, including their refusal of consent.

Even if end users cannot execute the “Right to Object” to the legitimate interest, users are always free to delete any TC Strings saved on their own device if they so desire – and then receive another prompt the next time they visit the relevant website.

In conclusion, considering that (A) the TCF specifies Special Purpose 3, that Adasta Media needs to fulfill in order to abide to the applicable law and respect users’ choices; and (B) the only legal basis that is applicable to the Special Purpose 3 under the TCF is the legitimate interest, Adasta Media is going to carry out this processing activity (“Special Purpose 3 – Save and communicate privacy choices”) to abide to users’ choices, considering that there are no risks nor impacts on data subjects and We believe our interests outweigh those interests of the data subjects. For any information, to exercise your rights, or to obtain further information or explanations, you can consult our Privacy Policy or contact Us:

  • by sending a registered letter with return receipt to our registered office (Viale Premuda, n. 46 – 20129 Milano);
  • by sending an email to: info@adasta.it.

You can also contact our DPO (dpo@adasta.it).