Where personal data might lawfully be processed because processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, or on grounds of the legitimate interests of a controller or a third party, a data subject should, nevertheless, be entitled to object to the processing of any personal data relating to his or her particular situation. It should be for the controller to demonstrate that its compelling legitimate interest overrides the interests or the fundamental rights and freedoms of the data subject.
GDPR Recital EN
Recital 69
Related across sources
Guidance Guidelines 2/2018 on derogations of Article 49 under Regulation 2016/679 Guidance Guidelines 3/2019 on processing of personal data through video devices Guidance Guidelines 02/2024 on Article 48 GDPR Guidance Guidelines 03/2022 on Deceptive design patterns in social media platform interfaces: how to recognise and avoid them Guidance Guidelines 05/2020 on consent under Regulation 2016/679 Guidance Guidelines 5/2019 on the criteria of the Right to be Forgotten in the search engines cases under the GDPR (part 1)