A controller justifies collecting detailed customer browsing histories solely because "everyone else in our industry does it." How should that justification be treated under Article 6?

Article 6 lists exhaustive lawful bases. “Everyone else in our industry does it” is not among them. Industry custom may inform reasonable expectations inside a legitimate-interests balancing test, or may explain commercial pressure, but it cannot by itself authorise collecting detailed customer browsing histories. Controllers—including civic digital services and private retailers—must map the collection to consent, contract, legal obligation, vital interests, public task, or legitimate interests with a proper assessment, and must still satisfy purpose limitation, minimisation, and transparency.

Industry custom does not automatically satisfy legitimate interests without further assessment; Article 6(1)(f) still demands necessity and balancing against data-subject rights. Custom does not create a public-task basis for private-sector controllers—public task requires a task in the public interest or official authority laid down by law. Market consensus also does not anonymise ordinary personal data; anonymisation is a technical and factual status under GDPR, not a popularity contest.

Exam caveat: candidates sometimes treat “reasonable expectations” as a freestanding basis. Expectations can weigh inside an LIA or fairness analysis, but the lawful basis must still be one of the Article 6 grounds with documentation to match.

Operational check: for the browsing-history use case, name the Article 6 basis in the record of processing, justify necessity and retention, ensure the privacy notice states specific purposes, and discard “industry standard” as the sole compliance rationale in any audit pack.