Controller’s legitimate interest can only be grounds for processing personal data for legitimate purposes, based on particular situations, which include but are not limited to:
I –support and promotion of the controller’s activity; and
II –protection of data subject’s regular exercise of her/his rights or provision of services that benefit her/him, subject to her/his legitimate expectations and fundamental rights and freedoms, in accordance with this Law.
§1When processing is based on the controller’s legitimate interest, only the personal data which are strictly necessary for the intended purpose may be processed.
§2The controller shall adopt measures to ensure transparency of data processing based on her/his legitimate interests.
§3The national authority may request of the controller an impact report on protection of personal data, when processing is based on her/his legitimate interest, being observed commercial and industrial secrecy.