While legitimate interest is one of possible exemptions to GDPR blanket ban, legitimate interest justification must be accompanied by a rights and freedom test.