A product team claims "legitimate interest" for a new profiling feature but has no documented balancing assessment. What should a CIPP/E-minded reviewer expect before relying on Article 6(1)(f)?

Article 6(1)(f) permits processing necessary for legitimate interests pursued by the controller or a third party, except where overridden by the data subject’s interests or fundamental rights and freedoms. A CIPP/E-minded reviewer therefore expects a real legitimate-interests assessment (LIA): identify the interest, show necessity of the profiling for that interest, and balance against individuals’ rights—including reasonable expectations, intrusiveness, and safeguards. Municipal and civic service teams adopting profiling features should apply the same discipline as commercial product groups: undocumented slogans are not an LIA.

A marketing slogan that the feature creates business value states an interest at best; it does not document necessity or balancing. A board minute preferring legitimate interests as a default basis confuses organisational preference with GDPR analysis—Article 6 requires a basis that fits the processing, not a corporate default. Proof that a competitor uses similar profiling is irrelevant to whether this controller’s interest is legitimate, necessary, and proportionate for these data subjects.

Exam caveat: legitimate interests is not “weaker consent.” It is a distinct basis with its own documentation and Article 21 objection rights. For profiling that produces legal or similarly significant effects, also keep Articles 22 and transparency duties in view; an LIA alone does not cure automated-decision restrictions.

Operational check: before go-live, file an LIA that a non-lawyer engineer can follow—purpose statement, necessity alternatives considered, balancing factors, mitigations (minimisation, retention, human review), notice language, and an objection handling path—and confirm the production system matches what the LIA describes.