Concept
Certain legitimate uses are the situations in Section 7 where a Data Fiduciary may process personal data without separate consent.
A Data Fiduciary may process personal data of a Data Principal for any of the following uses, namely: for the specified purpose for which the Data Principal has voluntarily provided her personal data; for the State to provide subsidies, benefits, services, certificates, licences or permits; for functions of the State; for legal obligations; for court orders; for medical emergencies; for public health measures; for disaster or public order; and for specified employment purposes.
Consent is not the only lawful basis. Section 7 lists specific uses, such as data a person voluntarily provides for a stated purpose, medical emergencies, public health, disaster response and defined employment purposes.
These are narrow and defined. They are not a general 'legitimate interest' catch-all, and each has its own conditions.
A pharmacy sending a payment receipt to a customer who voluntarily gave her number for that purpose relies on a certain legitimate use, not fresh consent.
See how this term differs from the ones people most often confuse it with.
Consent vs Certain Legitimate Uses →Is this the same as GDPR legitimate interest?
No. It is a closed list of defined uses, not an open balancing test.
Does a medical emergency need consent?
No. Responding to a medical emergency is a certain legitimate use under Section 7.