GDPR Legitimate Interests Legal Basis

What it is

For EU and UK users, Runway relies on 'legitimate interests' as its legal basis for a broad set of data processing activities including analytics, business improvement, security, and fraud prevention. This means Runway has assessed that its business interests outweigh user privacy interests for these activities.

Why it matters (compliance & governance perspective)

Legitimate interests is one of the broadest GDPR legal bases and is used here to cover analytics, service improvement, security, and fraud prevention. EU and UK users have the right to object to processing carried out under legitimate interests, which could limit how Runway processes their data.

Consumer impact (what this means for users)

EU and UK users have the right to object to data processing Runway conducts under legitimate interests, which covers analytics, business improvement, and security activities. Exercising this right may affect service functionality. Users can contact Runway at privacy@runwayml.com to exercise their right to object.

What you can do

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: This provision directly engages GDPR Article 6(1)(f) and UK GDPR equivalent provisions on legitimate interests as a lawful basis for processing. Under GDPR, reliance on legitimate interests requires a documented three-part balancing test: the interest must be legitimate, processing must be necessary, and the controller's interests must not be overridden by data subject rights. Enforcement authorities including the European Data Protection Board and national supervisory authorities have issued guidance on the scope of legitimate interests. 2) GOVERNANCE EXPOSURE: Medium. The policy names a broad set of activities covered by legitimate interests including customer service, analytics, business improvement, security, and fraud prevention, without disclosing the results of any specific balancing assessment. Supervisory authority enforcement decisions have found that overly broad or undocumented reliance on legitimate interests is a compliance risk, particularly for processing that involves profiling or behavioral analytics. 3) JURISDICTION FLAGS: EU member states and the UK both require that legitimate interests balancing assessments be documented and available to supervisory authorities. The scope of legitimate interests reliance may be subject to heightened scrutiny for AI companies that process large volumes of personal data for analytics and model improvement. German, French, and Irish data protection authorities have been active in examining legitimate interests claims by technology companies. 4) CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers subject to GDPR should evaluate whether Runway's reliance on legitimate interests for analytics and improvement processing is compatible with their own data processing obligations and the instructions they provide to Runway as a processor. Where Runway acts as a data controller for these purposes, enterprise customers should assess whether this is disclosed in their user-facing privacy notices. 5) COMPLIANCE CONSIDERATIONS: Runway's data protection team should maintain documented legitimate interests assessments for each category of processing covered by this basis. These assessments should be reviewed and updated when new processing activities are introduced or when the scope of existing activities changes materially. The right to object under GDPR Article 21 must be communicated to data subjects and honored in a timely manner.

Provision details

Other risks in this policy

• Biometric Data Collection high
• Advertising Partner Disclosure as Potential CCPA Sale high
• User Content Collection Including Prompts and Generated Outputs medium
• Enterprise Account Administrator Access medium
• Business Transferee Data Disclosure medium
• Children's Privacy and Age Restriction medium