Scenario: Bankbio is a financial institution that handles personal data of its customers. Its data processing activities involve processing that is necessary for the legitimate interests pursued by the institution. In such cases, Bankbio processes personal data without obtaining consent from data subjects. Questio n: Is the data processing lawful under GDPR?

The processing is lawful under the General Data Protection Regulation (GDPR). Article 6(1)(f) of the GDPR establishes "legitimate interests" as one of the six lawful bases for processing personal data. This basis is applicable when processing is necessary for the purposes of the legitimate interests pursued by the controller (Bankbio) or by a third party. However, this is not an absolute right. It requires a balancing test to ensure that these interests are not overridden by the interests or fundamental rights and freedoms of the data subject. Therefore, if Bankbio has conducted this assessment and concluded its interests are not overridden, the processing is lawful without consent.

B. This is incorrect because GDPR provides six lawful bases for processing under Article 6(1); consent is only one of them and is not always required.
C. This is incorrect because the "legitimate interests" basis is conditional and not applicable "in all cases"; it is subject to the crucial balancing test.
D. This is incorrect as GDPR does not impose a universal requirement for financial institutions to always obtain explicit consent; they can rely on other lawful bases.

1. Official Journal of the European Union, L 119/1. (2016). Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

Article 6(1)(f), Page 36: "processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."

Recital 47, Page 9: Explains the requirement for a careful assessment (balancing test) when relying on legitimate interests.

2. University of Edinburgh. (2023). Guidance on the Lawful Basis for Processing. Records Management Section.

Section: Legitimate Interests: "This is the most flexible of the lawful bases, but you must be able to demonstrate that you have balanced the rights and interests of the data subjects against your own. If their rights and interests override yours, you cannot use this basis." This document clarifies the conditional nature of the legitimate interests basis, reinforcing why options C and D are incorrect and A is correct.