“It’s just the data we need to protect our business. It’s legitimate interest, I promise”