The European Commission first drew attention to judgment C-13/16, Rigas satiksme, in which the CJEU recalled, with regard to Directive 95/46/EC, that the legitimate interest consists of a test in three parts (it has since confirmed the approach under GDPR): the establishment of the existence of a le...