A controller justifies collecting detailed customer browsing histories solely because "everyone else in our industry does it." How should that justification be treated under Article 6?
Select an answer to reveal the explanation.
Short Explanation
"Everyone else does it" is peer pressure, not a legal basis. Art. 6 lists consent, contract, legal obligation, vital interests, public task, and legitimate interests—not industry fashion. Pick a real ground and prove it fits.
Full Explanation
Article 6 enumerates exhaustive lawful bases. Market prevalence or industry custom is not among them and does not, by itself, establish legitimate interests, public task, or anonymisation. Controllers must identify an applicable Art. 6 ground and meet its conditions, including any balancing or necessity analysis for legitimate interests.