The Autoriteit Persoonsgegevens (‘AP‘), the Dutch data protection authority, has been almost alone in claiming that a legitimate interest must be a legal obligation, not just something legal a business…