UnderArticle 6(1)(f) of GDPR, processing is lawful if it isnecessary for the legitimate interests of the controller, unlessoverridden by the data subject’s rights and freedoms.

Option A is correctbecauselegitimate interest is a valid legal basis for processingunder GDPR.

Option B is incorrectbecauseexplicit consent is not requiredif another legal basis (such as legitimate interest) applies.

Option C is incorrectbecauselegitimate interest does not apply in all cases—the rights of the data subject may override it.

Option D is incorrectbecausefinancial institutions are not required to obtain explicit consent for all processing activities.

References:

GDPR Article 6(1)(f)(Legitimate interest as a lawful basis)

Recital 47(Legitimate interest includes preventing fraud and ensuring security)