The Netherlands' data protection authority's strict interpretation of the GDPR's "legitimate interest" ground for processing data has sparked a wave of criticism from privacy law professionals, local courts and even the European Commission.