Art. 10

Art. 10

Controller’s legitimate interest can only be grounds for processing personal data for legitimate purposes, based on particular situations, which include but are not limited to:

I – support and promotion of the controller’s activity; and

II – protection of data subject’s regular exercise of her/his rights or provision of services that benefit her/him, subject to her/his legitimate expectations and fundamental rights and freedoms, in accordance with this Law.

§1 When processing is based on the controller’s legitimate interest, only the personal data which are strictly necessary for the intended purpose may be processed.

§2 The controller shall adopt measures to ensure transparency of data processing based on her/his legitimate interests.

§3 The national authority may request of the controller a data protection impact assessment, when processing is based on her/his legitimate interest, being observed commercial and industrial secrecy.