A retailer relies on legitimate interests for fraud-prevention analytics and documents a balancing test weighing its interests against data subjects’ rights. What does valid use of Article 6(1)(f) require?
Select an answer to reveal the explanation.
Short Explanation
Legitimate interests are not a magic stamp that says ‘because we want to.’ You need a real interest, proof the processing is necessary for it, and a fair weighing against people’s rights—write that balancing test down. Fraud-prevention analytics can fit, but only if that homework is done.
Full Explanation
Legitimate interests under Article 6(1)(f) require a real interest, necessity of the processing for that interest, and a balancing test against individuals’ rights and freedoms. A retailer that relies on legitimate interests for fraud-prevention analytics and documents a balancing test weighing its interests against data subjects’ rights is following the structure EDPB-aligned analysis expects. Documentation supports accountability for that assessment.
A controller may not claim legitimate interests without identifying any interest or performing any balancing. Legitimate interests do not automatically override every objection or erase transparency duties. Article 6(1)(f) is generally not available to public authorities in the performance of their tasks—the public-task basis is the usual path for them—so saying (f) is only for public authorities reverses the rule of thumb.
Exam caveat: interest + necessity + balance (+ document); public authorities usually look to 6(1)(e), not 6(1)(f). Operational check: write legitimate-interest assessments, consider opt-outs where appropriate, honour objections under the override test, and keep notices accurate. Private civic-facing retailers should show customers that fraud controls are necessary and balanced—not a blank cheque labelled “legitimate interests.”