Scenario: Bankbio is a financial institution that handles personal data of its customers. Its data processing activities involve processing that is…

Under Article 6(1)(f) of GDPR, processing is lawful if it is necessary for the legitimate interests of the

controller, unless overridden by the data subject’s rights and freedoms.

Option A is correct because legitimate interest is a valid legal basis for processing under GDPR.

Option B is incorrect because explicit consent is not required if another legal basis (such as legitimate

interest) applies.

Option C is incorrect because legitimate interest does not apply in all cases—the rights of the data

subject may override it.

Option D is incorrect because financial institutions are not required to obtain explicit consent for all

processing activities.

Reference:

GDPR Article 6(1)(f) (Legitimate interest as a lawful basis)

Recital 47 (Legitimate interest includes preventing fraud and ensuring security)