Understand lawful processing bases including consent, contractual necessity, legal obligation, vital interests, public interest, and legitimate interests, and know EDPB guidelines and opinions on each basis.

An e-commerce company collected customer email addresses under consent to send a newsletter. It now wants to reuse the same addresses for a different purpose: an internal anti-abuse system that flags accounts associated with payment chargebacks, which it considers a legitimate interest. A colleague suggests the company can simply switch the recorded lawful basis from consent to legitimate interests for the original newsletter processing if engagement drops and consent becomes inconvenient. Applying EDPB guidance on lawful bases, what is the correct position on swapping the basis for that original processing?

• AA controller may freely alternate between lawful bases for the same processing whenever one becomes more convenient, provided the privacy notice lists all bases it might use.
• BThe controller cannot retrospectively switch from consent to legitimate interests for the same newsletter processing simply because consent becomes inconvenient; the basis must be identified before processing and a failed consent basis cannot be backfilled with another.check_circle Correct
• CThe company may switch to legitimate interests, but only after the supervisory authority approves the change in a prior consultation under Article 36.
• DThe company may switch the basis at any time because legitimate interests is a broader basis than consent and automatically absorbs any processing previously done under consent.

Why A is wrong: EDPB guidance rejects swapping bases for convenience; listing several possible bases does not licence switching when the chosen basis fails, so this contradicts the guidance.

Why B is correct: Correct. EDPB guidance holds that the lawful basis must be determined before processing begins and that a controller cannot retrospectively rely on a different basis when the original one fails or is withdrawn.

Why C is wrong: Article 36 prior consultation concerns residual high-risk processing after a DPIA, not changing a lawful basis; it does not authorise basis-swapping, so this misapplies the provision.

Why D is wrong: Legitimate interests does not automatically absorb consent-based processing; it requires its own balancing test and cannot be applied retroactively to processing built on a now-failed consent, so this is wrong.