A retailer relies on legitimate interests for fraud-prevention analytics and documents a balancing test weighing its interests against data subjects’ rights. What does valid use of Article 6(1)(f) require?
Select an answer to reveal the explanation.
Short Explanation
Legitimate interests are not a magic stamp that says ‘because we want to.’ You need a real interest, proof the processing is necessary for it, and a fair weighing against people’s rights—write that balancing test down. Fraud-prevention analytics can fit, but only if that homework is done.
Full Explanation
Article 6(1)(f) permits processing necessary for legitimate interests pursued by the controller or a third party, except where overridden by the interests or fundamental rights and freedoms of the data subject. Controllers must identify the interest, show necessity, and balance against data-subject rights; EDPB guidance (including Guidelines 1/2024 on legitimate interests) informs how to structure that analysis. Public authorities generally cannot rely on 6(1)(f) for tasks in the performance of their official duties.