[thrawn0r]

It's one of the reasons that allows a company to collect/process personal information without a) consent b) contractual obligation c) legal requirements

It's a bit loopholey, but has high hurdles since the processor needs to argue that their legitimate interest is bigger than the right for data privacy of the user. The processor has to create a DPIA (data privacy impact assessment) to show that they indeed balanced these both sides. The document can only be requested from the data protection authorities and are not public though.