Processing data under (f)
"legitimate interests" requires that processing is necessary. If an alternative approach could fulfill the same goal without processing personal data, then processing is not lawful without consent.