Set by the law · GDPR Art. 6(1)(f)
Legitimate interests
In plain English
Processing is lawful if necessary for a legitimate interest of the controller or a third party, unless the person's interests or rights override it, especially for a child. Public authorities cannot use it for their tasks.
The official text
processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Point (f) of the first subparagraph shall not apply to processing carried out by public authorities in the performance of their tasks.
At any rate the existence of a legitimate interest would need careful assessment including whether a data subject can reasonably expect at the time and in the context of the collection of the personal data that processing for that purpose may take place.
1,591 decisions on Fino cite Article 6 GDPR. See them →
Related
The official text is quoted word for word from the English version of the source named under it; only the version published in the Official Journal of the EU is legally binding. The plain-English line is Fino’s own summary, not legal advice.