The rights and legitimate interests of the personal data operator

the article examines the legal nature of the legitimate interest of a personal data operator as a basis for processing personal data without the subject’s consent, as established in Part 7 of Article 6 of the Federal Law “On Personal Data” [1]. The heightened attention to this issue is driven by the significantly strengthened administrative liability measures introduced in 2025 for violations in the field of personal data processing, including liability for large-scale data breaches. The author analyzes the conditions under which the processing of personal data without the subject’s consent is permissible, considering the need to observe the principles of legality, proportionality, and the inadmissibility of violating citizens’ rights and freedoms. Based on a systematization of judicial practice, it is revealed that courts predominantly adopt a restrictive approach to interpreting the operator’s legitimate interest, except in cases where such interest derives from other substantive legal norms (for example, in bankruptcy cases or in the protection of corporate rights). The research is based on the provisions of Russian legislation, as well as an analysis of key court rulings that shape the approach to the implementation of Part 7 of Article 6 of the Personal Data Law [1]. The author concludes that it is necessary to provide a regulatory clarification of the concept of “legitimate interest” and to develop a consistent law enforcement doctrine to ensure a balance between the protection of personal data and the legitimate interests of data operators.

Personal data, personal data operator, legitimate interest, subject’s consent, processing without consen, rights protection, Personal Data Law, debt collection, judicial practice, administrative liability