An organization processes personal data to train an AI model for targeted advertising. Under GDPR, which legal basis is MOST appropriate for this processing activity?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because GDPR requires explicit, freely given, specific, informed, and unambiguous consent for processing personal data for profiling used in targeted advertising, particularly when the processing involves automated decision-making or profiling under Article 22. Legitimate interest (A) requires a balancing test and is often challenged by regulators for advertising profiling.
Full explanation below image
Full Explanation
B is correct because GDPR requires explicit, freely given, specific, informed, and unambiguous consent for processing personal data for profiling used in targeted advertising, particularly when the processing involves automated decision-making or profiling under Article 22. Legitimate interest (A) requires a balancing test and is often challenged by regulators for advertising profiling. Contractual necessity (C) does not apply because advertising profiling is not necessary to fulfill a user service contract. Vital interests (D) applies only to life-threatening situations.