Recital 29a

Reliance on legitimate interest within the meaning of Article 6(1)(f) requires three cumulative conditions to be met: the pursuit by the controller or by a third party of an interest which is lawful, clearly and precisely articulated, and real and present rather than speculative; the necessity of the processing for that interest, which cannot reasonably be achieved by other means less intrusive for the data subject, including through the use of anonymised data; and the absence of an overriding of that interest by the interests or fundamental rights and freedoms of the data subject, having regard to the nature of the data, the context of the processing, its consequences, and the reasonable expectations of the data subject based on their relationship with the controller. Where those interests or rights would override the interest pursued, the controller may implement mitigating measures; where such measures are insufficient, the processing may not be based on that provision.