Issuance Text
Circular on Guidelines for Legitimate Interest
Questions Raised During the Public Consultation on 07 December 2023
General Questions
1. What is legitimate interest?
As stated in Section 3 (A) of the Circular, legitimate interest refers to any actual and real interest, benefit, or gain that a Personal Information Controller (PIC) or third party may have in or may derive from the processing of specific personal information. In simple terms, it talks about what the PIC is trying to achieve with that specific processing activity. A business purpose that is lawful and not contrary to law, morals, public order, and public policy may be a valid legitimate interest.
2. When does legitimate interest apply as a lawful basis for processing?
Legitimate interest applies as a lawful basis for processing personal information under Section 12 (f) of the Data Privacy Act (DPA). It is not a valid lawful basis when the processing involves sensitive personal information, which has been emphasized in Section 3 (B) of the Circular. The processing of sensitive personal information may be based on other lawful criteria under Section 13 of the DPA.
The Circular applies if the specific processing of personal information is based on legitimate interest, regardless of whether other applicable lawful criteria are declared. Note, however, that the specific lawful basis that the PIC or third party is relying on for that particular processing activity should be communicated to the data subjects following the principle of transparency and the data subject’s right to be informed.
Further, the general privacy principles will continue to apply regardless of the applicable lawful basis for processing. Nothing in Section 3 (B) of the Circular gives the impression that the general privacy principles no longer apply in the processing of personal information.
3. Whose legitimate interests are considered?
The legitimate interest of a PIC or a third party or parties to whom the personal information is disclosed is considered.
This is based on Section 12 (f) of the DPA which specifically identifies two (2) kinds of persons: (1) A PIC; and (2) a third party or parties to whom the data is disclosed.
Under Section 3 (C) of the Circular, a third party refers to any natural or juridical person to whom personal information is disclosed and who is not the PIC, the PIP, or the data subject of the specific processing activity.
4. Does the PIC need to provide a privacy notice informing the data subject that it is processing on the basis of legitimate interest?
Yes. While this is not explicitly stated in the Circular, PICs still have the obligation to inform its data subjects of the basis for processing following the general privacy principle of transparency and the data subject’s right to be informed.
A notice will always be required, regardless of whether the basis for processing personal information is consent, legitimate interest, or another lawful basis. The content of the notice will vary depending on the declared basis for processing. If the processing is based on consent, the notice should state that. If the processing is based on legitimate interest, this should also be clearly declared. This is provided in Section 16 of the DPA and Section 34 (a) (2) (c) of its Implementing Rules and Regulations.
To be clear, the Circular is not introducing a new basis for processing. Legitimate interest has always been provided in the DPA. The purpose of the Circular is to clarify the concept of legitimate interest to make it easier to utilize as a lawful basis for processing personal information.
A PIC or third party must assess whether relying on legitimate interest is more suitable for its purposes than other lawful bases such as consent.
5. If legitimate interest is the lawful basis for processing personal information, is there still a need for the data subject to explicitly state that they consent to the processing through a consent form?
No, since the PIC is now relying on legitimate interest and not consent. The PIC would, however, still need to communicate the notice requirements to the data subject through the consent form, because these notice requirements still apply regardless of the lawful basis for processing that the PIC is relying on.
6. Will a PIC be given a period to ensure compliance with the provisions of the Circular?
There is a transitory period of ninety (90) days from the effectivity of the Circular to give PICs time to comply with Section 8 (B) of the Circular.
Section 8 (B) of the Circular provides that “A PIC must keep the records of the legitimate interest assessment made as the basis for relying on Section 12 (f) of the DPA to process personal information.”
The transitory period is limited to Section 8 (B) of the Circular because if the PIC is or has been relying on legitimate interest as its basis to process personal information, then it should have conducted some version of the legitimate interest assessment, either separately or together with its privacy impact assessment.
Since the three (3) requisites for processing based on legitimate interest are not new and are just elaborations on what is already provided in Section 12 (f) of the DPA, the transitory period is just there to allow PICs or third parties to prepare the necessary documentation to show that they have satisfied all the requisites.
7. In a scenario where a party wishes to stop the disclosure of information, what if their basis is an assessment that they want to protect the data subject’s privacy?
It is important to remember that the DPA should not be used to facilitate the perpetuation of fraud and scams. The PIC cannot refuse to disclose the name and contact information of a person involved in a scam under the guise of protecting their privacy. For instance, if a person was scammed using a digital wallet application, and the application is aware of the scammer’s contact details, it would not be appropriate to withhold this information solely for privacy reasons. The interests of the person who was scammed also need to be considered. The Commission has already held that legitimate interest is a proper basis for the person that was scammed to request for the details of the scammer that are necessary for purposes of pursuing legal action.
8. What if, in our assessment, the details being requested by a party are not proportional to their legitimate interest in preventing fraud? What if they ask for more details than necessary to fulfill that legitimate interest?
There should be a discussion between the PIC and the requesting party about what is proportional, taking into account the stated purpose for their request. Proportionality should not be an arbitrary determination by the PIC. It must be based on the purpose of the request.
If a data subject wishes to file a case, the necessary information should be provided to them, so long as it is not protected by bank secrecy law or otherwise privileged information.
If the PIC decides not to provide certain information, it should document the reasons for this refusal.
It is important to remember that the determination of proportionality should not solely be from the PIC’s perspective but should also consider the third party’s objectives and the purposes it aims to achieve with the requested information.
Legitimate Interest of Third Parties
9. May a PIC rely on the legitimate interest assessment of the third party to whom the data is disclosed without conducting its own Legitimate Interest Assessment?
Yes. The PIC can rely on the legitimate interest assessment of the third party, or a combination of the documents submitted by the third party showing the presence of all three (3) requisites as stated in the Circular. What is important is that the third party can show its legitimate interest, the presence of the three (3) requisites, and the PIC is able to document all of these.
10. Is it required that both the PIC and the third party to whom personal information is disclosed have a legitimate interest?
No. It is not required that both the discloser and the recipient of the personal information have a legitimate interest.
Section 12 (f) of the DPA provides: “The processing is necessary for the purposes of the legitimate interests pursued by the personal information controller OR by a third party or parties to whom the data is disclosed, except where such interests are overridden by fundamental rights and freedoms of the data subject which require protection under the Philippine Constitution.”
What is important is that the PIC can verify the legitimate interest of the third party. It can conduct its own legitimate interest assessment or rely on the third party’s legitimate interest assessment or its equivalent.
To clarify, it is not necessary that both the PIC (disclosing party) and the third party (receiving party) have their own legitimate interest assessment.
For example: Person A hits Person B’s car and sped off. Person B only has the plate number of Person A’s car. Person B then goes to the LTO to ask for information, specifically the name and address of the registered owner of the car.
Person B can demonstrate their legitimate interest, but to expect LTO to have its own legitimate interest before it discloses the information requested would be problematic because in such instances, the PIC or the disclosing party may not have a legitimate interest in disclosing.
11. Can a request for information be rejected if the requesting party has legitimate interest? Or is there a legal obligation to provide information if the requesting party has legitimate interest?
It depends on the basis for the refusal to disclose. If the refusal is based solely on a lack of legitimate interest, then that is not a proper reliance on that basis. Section 12 (f) of the DPA states that either the PIC or the third-party recipient must have a legitimate interest. If the PIC has a lawful basis outside the DPA to prevent disclosure, then it can rely on that. However, using the DPA as the sole reason to not disclose could be problematic.
12. Is there a prescribed form or procedure for the verification conducted by the PIC of the third parties’ legitimate interest?
No. There is no prescribed procedure for verification of the legitimate interest of the third party under the Circular.
Similar to Section 4 of the Circular, the PIC may use any existing method, structure, or form, to verify the legitimate interest assessment that was conducted before the specific processing activity.
To emphasize, what is essential is that the third party can show that it has a legitimate interest in the particular processing activity with proper documentation showing the presence of all three (3) requisites.
13. Should the third party send out prior notice to the disclosing PIC concerning any subsequent processing?
No. When the third party subsequently processes the personal information it receives, the third party becomes a PIC and will be treated as such.
Requisites for Processing Based on Legitimate Interest
14. In relation to the purpose test in Section 5 and the necessity test in Section 6, does a PIC need to fulfill all the elements of those two tests to establish its legitimate interest?
Yes. Since Sections 5 and 6 of the Circular talk about the general privacy principles of legitimate purpose and proportionality, the language is not new. As such, all the elements under the purpose test (Section 5) and the necessity test (Section 6) must be complied with.
To demonstrate, the PIC cannot have a situation where the purpose for processing is specific but contrary to law. Thus, all three (3) elements under Section 5 and both elements under Section 6 of the Circular must be met.
B. The means to fulfill the legitimate interest is both necessary and lawful
15. What does “necessary’ mean?
As the Commission previously held, the qualifier “necessary” refers to the general privacy principle of proportionality. Following this principle, the means must be adequate, relevant, suitable, and necessary, such that it is not excessive in relation to the declared and specified purpose.
Since the first requisite, which is the legitimate interest is established, refers to the purpose, “necessary” in relation to the second requisite refers to the means the PIC chooses to achieve its purpose.
16. A PIC or third party must determine the “measures implemented to protect the personal information involved in the specific processing activity or to mitigate the effect or impact of the specific processing activity on the data subject (e.g., privacy-enhancing technologies).
If the PIC or third party has implemented existing measures to protect the personal information involved, does it satisfy the second factor? Or does it still depend on the effectiveness of the implemented measures based on the privacy impact assessment and other assessments?
Yes, the PIC has to look at the effectiveness of the measures and that will depend on the good faith assessment of the PIC or third party.
It is important to clarify that the enumeration in Section 7 of the Circular are factors that may be considered to determine the effect or impact of accomplishing the legitimate interest. These are not requisites.
C. The interest is legitimate and lawful, and it does not override fundamental rights and freedoms of data subjects
17. How is the effect or impact of accomplishing the legitimate interest determined?
Determining the effect or impact of accomplishing the legitimate interest requires an analysis of the totality of the three (3) requisites.
The first requisite asks, “what is the PIC’s purpose?” The second requisite asks, “how is the PIC achieving that purpose?” The combination of those will give the PIC the effect or impact on the data subject.
To determine if the interest overrides fundamental rights and freedoms, the PIC or third party may consider the following factors:
- Effect or impact of the specific processing activity on the data subject;
- Measures implemented to protect the personal information or to mitigate the effect or impact on the data subject;
- Availability of other means or methods to fulfill the legitimate purpose; and
- Reasonable expectation of the data subject on the specific processing of their personal information.
The effect or impact of accomplishing the legitimate interest is viewed based on the surrounding circumstances of each case.
18. COMMENT: “[T]he first sentence of Section 7 appears to be a restatement of Section 4 regarding the importance of the fulfillment of the requisites for legitimate interest. As such, we find it fitting to integrate the same in Section 4.”
The first sentence of Section 7 of the Circular is not a restatement of Section 4 of the Circular. Section 7 provides that in assessing the effect or impact of accomplishing the legitimate interest, the PIC or third party should consider the purpose of processing (first requisite) and the means by which it is achieved (second requisite). It is the combination of the first two requisites that will determine the effect or impact of the processing.
For example: In the case of debt collection, which is a legitimate purpose, the effect to the data subject is not determined solely based on the purpose, which is debt collection, but how the PIC or third party goes about achieving debt collection. Does the PIC individually notify each person that has a debt, or does the PIC now publicize it on social media and announce to the world that this person has a debt? The purpose of collecting debt may be the same, but the means of fulfilling it can have different effects on the data subject.
19. The third factor provides that a PIC or third party must also consider the availability of other means or methods to fulfill the legitimate purpose.
If there are other methods to fulfill the legitimate purpose and the PIC or third party fails to use the same, does that mean there is a failure to satisfy the third factor? What if both methods can fulfill the legitimate purpose?
It is the obligation of the PIC or third party relying on legitimate interest to choose the least intrusive method taking into consideration the PIC or third party’s particular circumstances.
The Commission considers the particular circumstances of the PIC or the third party. For example, if a PIC can utilize privacy enhancing technologies to make processing less intrusive, but the implementation of that requires an investment of resources and capital that the PIC cannot reasonably shoulder at that point, then the Commission will take those into consideration in determining the applicability of the third factor.
20. What is a “reasonable expectation”?
The reasonable expectation of the data subject is understood based on what a reasonable person would find acceptable under the circumstances. This is not discretionary, rather, it is viewed based on the surrounding circumstances of each case.
The Commission has already issued decisions explaining this and clarified that the reasonable expectation of privacy discussed here is not the same reasonable expectation of privacy in Ople v. Torres.
Reasonable expectation of privacy is in terms of further processing of personal information given the specific circumstances surrounding the processing activity such as the original business arrangement between parties.
21. COMMENT: “Reasonable expectation must not be discretionary, all possible reasonable expectations must be given to the data subject upon obtaining consent to be compliant to the data subject’s right to be informed of the purposes for which they are being or will be processed, including processing for all legitimate interests of the PIC, or the data subject such as processing for direct marketing, profiling, or historical, statistical or scientific purpose.
Also, the data subject shall be given the opportunity or the right to object to the processing of the personal data, in relation, to the other legitimate interests particularly those favorable to the PIC or the PIP.”
There may be some misinterpretation regarding the concept of a reasonable expectation of privacy in this context. There is a difference between the reasonable expectation of a data subject discussed in the previous question and what data subject can expect following the obligation of the controllers to provide them with information on the scope, purpose, nature, and extent of the processing.
Under Section 34 (b) under the Implementing Rules and Regulations of the DPA, the right to object is also not absolute. Data subjects can exercise it in instances when the basis for processing is consent or legitimate interest.
Therefore, the data subject should be given an opportunity to object.
The Commission highlights that the Circular does not change the lawful basis for processing that is legitimate interest. It just provides clarifications to make it easy for people to rely on legitimate interest as basis for processing, so that they avoid over reliance on consent.
Legitimate Interest Assessment (LIA)
22. What should the legitimate interest assessment contain? Are there required contents?
A legitimate interest assessment should contain information on how the PIC or third party fulfills the requisites for processing based on legitimate interest.
It is important to emphasize the existence of proper documentation indicating that the PIC or third party has thoroughly assessed whether it can properly rely on legitimate interest as its basis for processing following the three (3) requirements, including being able to substantiate all of these with evidence.
23. Will the NPC release guidelines for the legitimate interest assessment?
The guidelines for fulfilling these requisites are provided in Sections 5 to 7 of the Circular.
24. Is there a prescribed form for a legitimate interest assessment?
No. There is no prescribed form for a legitimate interest assessment as stated in Section 4 of the Circular. The Commission will not release a template because each legitimate interest assessment will depend on the circumstances of the case.
The PIC or third party may use any existing method, structure, or form, provided the PIC or third party applies the requisites for processing based on legitimate interest in its assessment. This may even be included in the conduct of a privacy impact assessment. It also doesn’t even have to be in one document, it can be one document or several documents with annexes.
The important thing is to have proper documentation showing that all three requisites are fulfilled.
25. Under Section 4, which outlines the requisites for processing based on legitimate interest, it is mentioned that there is no prescribed form for the legitimate interest assessment. In this case, is email correspondence an acceptable means?
Yes. Email correspondence is acceptable as long as it demonstrates that the three requisites for processing based on legitimate interest are fulfilled in that specific case.
Consider a situation where someone wants to obtain the name of a person who scammed them through a payment wallet or platform. This individual paid but the goods were not delivered. Thus, the scammer’s name and contact details are being requested from the payment platforms.
In such cases, there might not be formal documentation, but screenshots of email or message correspondence, whether through messenger or other platforms like Facebook Marketplace, can serve as evidence. As long as it clearly demonstrates the fulfillment of the three (3) requisites for legitimate interest in relation to the third party, using email correspondence should be acceptable.
26. Will the NPC require the submission of the legitimate interest assessment?
As stated in Section 8 (C) of the Circular, the NPC may require the submission of the records of the legitimate interest assessment in cases of investigations or compliance checks.
The legitimate interest assessment is not a new requirement. Any PIC or third party relying on legitimate interest as a lawful basis for processing personal information should have conducted an assessment, whether separately or as part of its privacy impact assessment, to determine if legitimate interest is the most applicable lawful basis for a specific processing activity. Following this, a legitimate interest assessment should also be conducted on existing processing activities that involve personal information.
27. How often should a legitimate interest assessment be conducted?
A PIC or third party should regularly conduct a legitimate interest assessment. If a PIC or third party is relying on legitimate interest as its basis for a specific processing activity, then it should assess if legitimate interest continues to be the most suitable lawful basis for that specific processing activity.
The degree of regularity depends on the circumstances of each case. We cannot provide a specific period because PICs are in a better position to know when it is needed to conduct a legitimate interest assessment. The important thing is that a PIC should regularly conduct one and that it is a continuing requirement. It is not a one-time assessment.
28. Can we incorporate a legitimate interest assessment as part of the privacy impact assessment?
Yes, it can be incorporated because it essentially forms part of the privacy impact assessment. The privacy impact assessment evaluates all the various processing activities the PIC is involved in, and the legitimate interest assessment is just one component of that. It specifically addresses situations where legitimate interests serve as the lawful basis for processing.
29. Regarding documentation under Section 8 for routinary or recurrent processes, will a one-time privacy impact assessment suffice, and how long should the documentation be kept?
A one-time privacy impact assessment may not be sufficient because regular evaluations of compliance with the requisites for legitimate interest are necessary. Just like a privacy impact assessment, legitimate interest assessments should not be treated as a one-time requirement. They assess the ongoing compliance of the PIC. If there are changes in the PIC’s organization, such as launching a new project or product, or altering processes, the PIC is required to conduct a new privacy impact assessment or legitimate interest assessment for that change.
As for how long the documentation should be kept, it should be retained as long as the particular process is in place. In the event of an investigation or compliance check, the documentation may be requested. Failure to have adequate documentation while continuing a processing activity relying on legitimate interest could pose challenges. Therefore, it is advisable to maintain documentation as long as the relevant process is ongoing.
Further Processing of Personal Information Based on Legitimate Interest
30. May further processing of personal information be based on legitimate interest?
Yes. Under Section 9 of the Circular, personal information originally collected based on consent may be processed further for additional purposes that constitute a legitimate interest of the PIC or third party.
In doing so, the PIC or third party must conduct a legitimate interest assessment on the further processing of personal information.
For example: A creditor collected a debtor’s personal information based on consent through the contract’s terms and conditions and consent forms; but during the course of that relationship, the creditor wanted to file a case against the debtor. His information may be further processed based on a legitimate interest.
Hence, if one person wants to file a case against another person and he needs the personal information of the accused in order to file the case, he can use as basis for processing Section 13 (f) in relation to Section 12 (f) of the DPA even if personal information was originally collected based on consent.
31. Is consent required for further processing based on legitimate interest?
No, consent is not required since there is already a lawful basis for that further processing. The lawful basis for the further processing would be legitimate interest.
If the processing activity contemplated by the PIC is already covered by the consent given by the data subject, then the PIC doesn’t even need to look at legitimate interests. It can just rely on the consent. It will depend on the PIC to figure out what is the most appropriate lawful basis for that particular processing activity.
32. COMMENT: Regarding Section 9, we propose that it be revised to clarify that as long as consent has been obtained in compliance with applicable requirements (e.g. Circular on the Guidelines on Consent), further processing for additional purposes should be permitted under the legitimate interest basis. We believe that this is what Section 9 intends to convey but suggest that the reference to the Circular on the Guidelines on Consent be clearly tied to the consent originally obtained.”
This is not the intention of Section 9 of the Circular. The Commission emphasizes that Section 9 provides “may”. How the PIC goes about achieving that legitimate interest is an important consideration.
33. By what channel or means should PIC’s report the results of the legitimate interest assessment to NPC. Is it going to be a compliance report that needs to be submitted at certain times of the year?
No, PICs are not required to submit the legitimate interest assessment through a mandatory compliance report at specific times of the year. Submission is only necessary if they are the subject of a compliance check or investigation, where the Complaints and Investigation Division (CID) or the Compliance and Monitoring Division may request the submission of the legitimate interest assessment. In the absence of such circumstances, there is no obligation to submit the legitimate interest assessment.
It is helpful to look at legitimate interest assessment in the same way as the privacy impact assessment, as it constitutes a part of the latter. Currently, the NPC does not require the submission of privacy impact assessments unless an entity is under investigation or subject to a compliance check. The same principle could apply to legitimate interest assessments.
Sectoral Determination of Specific Legitimate Interest
34. Is it mandatory for sectors to determine common personal information processing activities within their respective industries that may be based on legitimate interest?
No. Section 11 of the Circular is not mandatory. It expressly states that the NPC encourages industry sectors to undertake this task. It is not an obligation but rather a recommendation.
This encouragement is intended to be beneficial for both the sectors involved and the NPC. Establishing a common understanding of normal processing activities within a particular sector can streamline the process, eliminating the need for guesswork in each instance. While this is beneficial, it’s important to remember that each case still needs individual consideration. Despite this, having sectoral determinations in place will be very helpful.
35. Will the NPC release a list of common legitimate interests for each sector or in general?
No, the Commission will not release such a list. The concern is avoiding a situation where individuals could claim any form of data collection or fraud prevention as a legitimate interest, enabling them to justify any action.
The first requirement in determining legitimate interest goes into what the PIC’s purpose is and whether the purpose is lawful and does not go against morals, public order, and public policy. Making such a determination is relatively straightforward; the critical aspect lies in how one goes about achieving that purpose.
Creating a list of common legitimate interests for each sector or in general might be counterproductive, as it could overlook the specific methods and means necessary to achieve a legitimate interest in a given context.
36. Medical technology companies need to process health data both when developing new technologies and as part of their rollout to healthcare systems. In general, Medical Technology Companies act as processors.
Given this scenario, can the medical technology sector work on a sectoral determination of specific legitimate interests?
Yes, the medical technology sector can work on the sectoral determination of legitimate interests. It’s important to note, however, that legitimate interest applies solely to the processing of personal information and not sensitive personal information.
Since health data likely falls under sensitive personal information, legitimate interest may not be the most suitable criteria for processing. Instead, engaging in proper research, relying on the provisions in Section 4 of the DPA, is recommended. This involves conducting proper research that is cleared by an ethics board and documented appropriately, among others.
Given the nature of health data, legitimate interest may not be the best criteria to rely on, but the sector is free to come up with its sectoral determination of specific legitimate interests.
Processing carried out by Public Authorities
37. When may public authorities rely on legitimate interest as their lawful basis for processing personal information?
When processing personal or sensitive personal information, public authorities should primarily rely on their mandate as provided by law or regulation.
As outlined in Section 12 of the Circular, a government agency can resort to legitimate interests as basis for processing, but only for ancillary processing activities conducted in the ordinary course of its business, not to fulfill its mandate. This includes activities such as office management, employee welfare, and financial accountability.
In such instances, a legitimate interest assessment must still be conducted to ascertain whether legitimate interest is the most appropriate and suitable legal basis for that specific processing activity.
38. In relation to Section 10, to clarify, third parties do not include the PICs with whom we have an existing data sharing agreement?
No, that is incorrect. An existing data sharing agreement is not considered a lawful basis for processing, as emphasized in our Circular on Data Sharing Agreements. A data sharing agreement outlines the process and mechanism for sharing information, specifying how it’s operationalized, the duration, and other relevant details. However, it does not serve as the basis for the actual sharing.
When sharing information with third parties, it is crucial to identify the basis for this sharing. If the basis is legitimate interest, a version of a legitimate interest assessment should be in place. If a previously executed data sharing agreement already includes the requisites for a legitimate interest assessment, it can be sufficient. However, it is essential to recognize that a data sharing agreement itself is not the lawful basis for processing.
Therefore, it is necessary to understand why information is shared with other PICs, even if there’s an existing data sharing agreement. Is the sharing based on consent, contract, legal requirement, or legitimate interest? In the absence of the former, it might be that the sharing is based on legitimate interests, and in such cases, proper analysis and documentation are imperative.
39. Is the sector required to submit the sectoral determination of common legitimate interest to the NPC?
No, there is no mandatory requirement for sectors to submit the sectoral determination of common legitimate interest to the NPC. Section 11 encourages sectors to voluntarily come up with their common legitimate interests. It may, however, be beneficial for the sector to submit it to the NPC once established. This submission can provide the NPC with a clearer understanding of the common legitimate interests and means of achieving those interests within that specific sector. Consequently, this aids the NPC in analyzing and recognizing practices that regularly occur within that sector which helps enhance overall comprehension.
40. If legitimate interest is used for further processing not covered by consent, must the data subject receive fresh notification or opportunity to object?
Yes, a fresh notification is required. It is essential to clarify that the right to be informed, grounded in the principle of transparency, is a constant requirement. Even if a different lawful basis, other than consent, is utilized for processing, the obligation to provide a privacy notice persists, as consistently emphasized by the Commission. If there are new developments or changes in processing activities, the data subject must be notified.
In the context of relying on legitimate interest as a basis, the data subject retains the right to object, and this right does not expire. However, it’s important to note that the right to object is not absolute. For instance, in cases when the basis for processing is legitimate interest, the data subject can exercise their right to object. However, this will not stop the processing if another basis for processing exists such as when pursuing a legal claim under Section 13 (f) of the DPA. As always, these determinations are made on a case-to-case basis.