Legitimate business purpose is another basis for processing personal data, but it can't override interests of the data subject: https://gdpr-info.eu/art-6-gdpr

Legitimate business purpose is another basis for processing personal data, but it can't override interests of the data subject: https://gdpr-info.eu/art-6-gdpr/ https://gdpr-info.eu/art-6-gdpr/ It's like asking why a doctor can't sedate you and transplant your kidney, you have another one so you don't need it and they'll make a ton of money.