The legitimate interest of the controller may only substantiate processing of personal data for legitimate purposes, considered from concrete situations, which include, but are not limited to:
I - support and promotion of controller activities; and
II - protection, in relation to the holder, from the regular exercise of his rights or rendering of services that benefit him, respecting his legitimate expectations and fundamental rights and freedoms, under the terms of this Law.
- 1 When processing is based on the legitimate interest of the controller, only personal data strictly necessary for the intended purpose may be processed.
- 2. The controller shall take measures to ensure the transparency of data processing based on its legitimate interest.
- 3. The national authority may request from the controller an impact report on the protection of personal data, when the treatment is based on its legitimate interest, observing the commercial and industrial secrets.