106As the Court has already held, that provision lays down three cumulative conditions so that the processing of personal data covered by that provision is lawful, namely, first, the pursuit of a legitimate interest by the data controller or by a third party; second, the need to process personal data for the purposes of the legitimate interests pursued; and third, that the interests or fundamental freedoms and rights of the person concerned by the data protection do not take precedence over the legitimate interest of the controller or of a third party (judgment of 17 June 2021, M.I.C.M., C‑597/19, EU:C:2021:492, paragraph 106 and the case-law cited).
Source: EUR-Lex, © European Union, 1998-2026. Reuse authorised under Decision 2011/833/EU.