A product team claims "legitimate interest" for a new profiling feature but has no documented balancing assessment. What should a CIPP/E-minded reviewer expect before relying on Article 6(1)(f)?
Select an answer to reveal the explanation.
Short Explanation
Legitimate interest is not a magic stamp you slap on a feature. You need a real LIA—what you want to do, why you need that data, and whether the person's interests outweigh yours. A slogan or "competitors do it" will not cut it.
Full Explanation
Article 6(1)(f) requires that processing be necessary for legitimate interests pursued by the controller or a third party, except where overridden by the data subject's interests or fundamental rights. Accountability expectations and EDPB guidance call for a documented assessment covering the interest, necessity, and balancing test. Business preference, competitor practice, or unsupported slogans do not satisfy that analysis.