A data subject objects to processing that the controller bases on legitimate interests. What must the controller do?
Select an answer to reveal the explanation.
Short Explanation
An objection is not a suggestion box card you can ignore. When someone says stop processing under legitimate interests, you pause that use unless you can show stronger grounds that really override theirs—or you need the data for a legal claim. Assess it properly; do not autopilot.
Full Explanation
Under Article 21, data subjects may object to processing based on legitimate interests. The controller must cease that processing unless it demonstrates compelling legitimate grounds that override the data subject’s interests, rights and freedoms, or that processing is necessary for the establishment, exercise or defence of legal claims. A proper assessment—not automatic continuation—is required.