"You must balance your interests against the individual’s. If they would not reasonably expect the processing, or if it would cause unjustified harm, their interests are likely to override your legitimate interests."

https://ico.org.uk/for-organisations/guide-to-the-general-da...