A privacy notice does not create permission
Telling people what you do with their data is an obligation. It is not the thing that makes it lawful.
The notice is transparency; the lawful basis is authorisation, and they are separate requirements. Publishing a long notice describing extensive processing does not legitimise that processing. "It is in our privacy policy" is an answer to a different question from the one usually being asked.
More on Privacy engineering
- Anonymisation is about re-identification riskThe name was the easy part
- Differential privacy limits one person's influenceOne person cannot move the needle
- Consent interfaces can undermine genuine choiceBoth answers, very different distances
- Purpose limitation prevents silent mission creepThe pipe was laid for one thing
- Privacy by design moves decisions earlierA line on the plan, or a hole in the wall
- Data subject rights depend on finding the dataThe right ends where the index does