EUGDPRLawful BasesEASYFree question
The legitimate interests basis under Article 6(1)(f) requires:
- A.Only a declaration that the interest is legitimate, citing Article 5(1)(a), which requires consent as the only lawful basis for any processing to be fair and lawful
- B.Consent from the data subject, citing Article 6(3), which requires the legal basis under Article 6(1)(c) or (e) to be laid down in EU law only, never member state law
- C.A balancing test between the controller's interests and the data subject's rights
- D.Approval from the supervisory authority
Why C is correct
Legitimate interests requires identifying a legitimate interest, showing processing is necessary, and conducting a balancing test against the data subject's rights and freedoms.
Know someone studying for GDPR? Send them this one.