The Legitimate Interests basis for processing personal data is a qualified one, though: >processing is necessary for the purposes of the legitimate interests p

The Legitimate Interests basis for processing personal data is a qualified one, though: >processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. So where there is any doubt one must test the idea that the data subject's rights outweigh one's legitimate interests.