In a blogost, the commissioner said: "We recognise that organisations want more information about [legitimate interests]. There is already guidance about legitimate interests under the current law on the ICO website and from the Article 29 Working Party. We’re working with the other European authorities to publish guidance on it next year."
The delay has already sparked action by the Data Protection Network, which has published its own guidance area following a collaboration with the DMA, ISBA, and data protection specialists.
The DPN guidance is a practical tool to help commercial and not-for-profit organisations assess whether or not they can rely on legitimate interests as a lawful basis for processing personal data under the GDPR.
Meanwhile, Denham also confirmed that consent guidance will not be published until the end of 2017. She added: "I know many people are waiting for us to publish our final guidance on consent. Businesses want certainty and assurance of harmonised rules. Waiting until Europe-wide consent guidelines have been agreed before we publish our final guidance is key to ensuring consistency. The current timetable is December."
However, she raised more than a few eyebrows by insisting: "The ICO’s draft guidance on consent is a good place to start right now. It’s unlikely that the guidance will change significantly in its final form. So you already have many of the tools you need to prepare." This is despite fears raised by many - including the DMA - that the draft is over prescriptive.