Before the data is processed the data subject is to be informed in a manner (explicit and in plain words) described in Articel 13 of the GDPR, which in (1) lit.

Before the data is processed the data subject is to be informed in a manner (explicit and in plain words) described in Articel 13 of the GDPR, which in (1) lit. d sates: "where the processing is based on point (f) of Article 6(1), the legitimate interests pursued by the controller or by a third party;" The rational behind this: "The controller should provide the data subject with any further information necessary to ensure fair and transparent processing taking into account the specific circumstances and context in which the personal data are processed." (Recital 60, Sentence 2) The right to object is Articel 21 of the GDPR. I am not citing the whole Articel here but it is worth reading however Sentence 2 of Recital 69 sates: "It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject."