The classic trap
Recital 69 illuminates Article 21 GDPR on the right to object. The trap regularly sanctioned by the CNPD and CNIL: controllers respond to objection requests with a templated refusal ("your request is denied because our legitimate interest prevails") without ever documenting the actual balancing test. Yet Recital 69 explicitly reverses the burden of proof: it is for the controller to demonstrate that its compelling legitimate interest overrides, not for the citizen to prove the opposite. The EDPB, in its guidelines on legitimate interest as a legal basis, reminds that this demonstration must be prior, documented and reassessed at each objection.
The 'compelling' test: the key argument before the CNPD
The word compelling is not decorative. It raises the standard of proof after an objection. Before objection, a simple legitimate interest is enough. After objection, the controller must demonstrate a compelling interest, meaning:
- A concrete, current and real interest, not a theoretical or future justification
- A genuine necessity of the processing for that interest (no less intrusive alternative)
- A documented balancing test taking into account the particular situation invoked by the person
- An assessment of the reasonable expectations of the data subject at the time of collection
- A consideration of the concrete consequences of the processing on their rights and freedoms
- A dated written record of this analysis, ready to be produced to the CNPD within 30 days
Without this record, the objection must be upheld. CNPD and CNIL decisions show that an unsubstantiated refusal is systematically reclassified as a violation of Article 21.
How Luxgap automates this risk
Our Luxgap Objection Defender turns every objection request into an opposable legal file in under 10 minutes, where your teams currently spend hours producing manual and approximate wording. The tool triggers a legal AI agent as soon as an objection arrives (web form, DPO email, scanned letter) and automatically reconstructs the Article 21 balancing test from your Article 30 register, your initial LIA and the particular situation invoked.
- Automatically detects incoming objection requests via Outlook, Gmail, Zendesk, Freshdesk and contact form connectors, without relying on human flagging.
- Reconstructs the balance of interests based on the original LIA, the Article 30 register and the EDPB grid on legitimate interest, quantifying the actual impact on the data subject.
- Generates a point-by-point reasoned response (acceptance or argued refusal) signed by the DPO, compliant with the one-month deadline under Article 12(3).
- Automatically flags cases where refusal is legally untenable and recommends acceptance to avoid a CNPD complaint.
- Produces a time-stamped, cryptographically sealed PDF defence file, opposable in case of complaint or audit, demonstrating that the burden of proof has been properly assumed.
- Alerts on processing activities where the objection rate exceeds a critical threshold, an early signal that the legitimate interest basis is no longer tenable.
Available as part of a Luxgap DPO mandate or as a dedicated SaaS module depending on your objection volume. Request a demonstration on your real data and our teams will run a free 48h white audit of objections handled over the past 12 months, to measure your exposure before any engagement.
