Annex 1a

15a.After Annex 1, the following Annex is added:

"ANNEX Ia

Legitimate interests within the meaning of point (f) of the first subparagraph of Article 6 paragraph 1 include, but are not restricted to:

1.Legal and Regulatory Compliance

a.preventing, detecting or investigating fraud and other criminal activities;

b.ensuring workplace safety and security (eg, CCTV monitoring in public areas of the workplace or monitoring premises with sensitive operations);

c.conducting audits or compliance checks;

d.reporting illegal activities or threats to public safety to authorities;

e.cooperating with authorities in situations of emergency.

2.Business Operations and Management

a.ensuring the proper functioning of equipment, IT systems or infrastructure;

b.ensuring network and information security (eg, preventing unauthorised access or cyberattacks) and preventing misuse of services or systems (eg, detecting bots or spam);

c.protecting the controller’s or a third party’s assets, reputation, or intellectual property;

d.establishing, exercising, or defending legal claims;

e.monitoring business performance or productivity.

3.Research and Development

a.conducting scientific or historical research;

b.improving products or services (eg, based on customer feedback);

c.developing new technologies or services (eg, training, validating or testing of artificial intelligence);

d.clinical trials;

e.archiving or statistical activities in the public interest.

4.Distribution and Marketing

a.ensuring seamless transactions and user experiences on websites or apps;

b.maintaining customer records for service continuity;

c.conducting market research or customer satisfaction surveys;

d.measuring the effectiveness of marketing campaigns.

5.Business Transactions

a.transfers of employee, customer or supplier files within a group of companies;

b.carrying out mergers, acquisitions, or similar business transactions;

c.conducting due diligence in business transactions;

d.assignment of claims, or provision of claims as a security, within common financial transactions.

The fact that a processing operation is covered by subparagraph 1 does not exempt the controller from ensuring that the processing operation is necessary for the purposes of the relevant legitimate interests pursued by the controller or by a third party, and that the interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. In doing so, the controller shall take into account, among others, the possible consequences of the intended processing for data subjects and the existence of appropriate safeguards."