What information should an information clause contain when the legal basis for data processing is the controller's legitimate interest?
ANSWER
Such an information clause, in accordance with Article 13(1)(c) and (d) GDPR, should include information about the controller's legitimate interests as the legal basis for processing and an explanation of what those legitimate interests consist of. The clause should also fulfil all other requirements set out in Article 13 GDPR, and if the data were obtained indirectly, the requirements of Article 14 GDPR must also be observed.
