When responding to a DSAR (Art 15), the controller must list the purposes for which the personal data is being processed.
When obtaining personal data (Art 13 & 14), the controller must inform the data subject about the intended purposes of processing, the legal basis, and if the legal basis is a legitimate interest, those legitimate interests pursued by the controller or a third party.
Usually, this information is combined into a single document and then published as a privacy policy, to which the data subject is referred when responding to a DSAR.
I cannot find a reason to provide further justification on the legitimate interests. However, in the Guidelines on Transparency, the WP29 (adopted by the EDPB) write:
The specific interest in question must be identified for the benefit of the data subject.
As a matter of best practice, the controller can also provide the data subject with the information form the balancing test, which must be carried out to allow reliance on Article 6.1(f) as a lawful basis for processing, in advance of any collection of data subjects' personal data.
To avoid information fatigue, this can be included within a layered privacy statement/ notice (see paragraph 35).
In any case, the WP29 position is that information to the data subject should make it clear that they can obtain information on the balancing test on request.
This is essential for effective transparency where data subjects have doubts as to whether the balancing test has been carried out fairly or they wish to file a complaint with a supervisory authority.
– WP29 (2018): Guidelines on Transparency under Regulation 2016/679. WP260 rev.01. URL https://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=622227
So the WP29/EDBP is of the opinion that data subjects are entitled to get the controller's balancing test (sometimes also called a legitimate interest assessment). I can see no explicit legal basis for this interpretation, and it can just be inferred indirectly from the more general transparency principle or accountability principle. I am not necessarily convinced this interpretation would be upheld by a court.
The ICO instead sees a more limited scope:
You must tell individuals:
- what your purpose for processing personal data is;
- that you are relying on legitimate interests as your lawful basis; and
- summarise what the relevant legitimate interests are.
– ICO: Legitimate interests: What else do we need to consider? In: Guide to the General Data Protection Regulation (GDPR). URL: https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/legitimate-interests/what-else-do-we-need-to-consider/
A summary of the legitimate interests points to a fairly terse list similar to that which you have shown.
Note that in the given list of alleged legitimate interests, there are some odd entries such as “to meet legal requirements”. This indicates Art 6(1)(f) legitimate interest is incorrect, and Art 6(1)(c) legal obligation should be used instead as the legal basis, unless the legal requirement does not stem from EU or member state law. Also, any “advisors” should instead be bound as data processors, which would make it unnecessary to find a legal basis to share personal data with them. “Data analytics projects” is incredibly vague, and not a legitimate interest unless the data analysis is performed for achieving another purpose such as to “improve our Services”.
