A: Yes. As is the case with the Directive itself, the safe harbor does not create unqualified requirements to seek the consent of the individual, to inform individuals that their data is being processed, or to give individuals access to their data. Exceptions are permitted, for example, where the public interest requires or when processing is necessary for legitimate interests pursued by the organization or third parties to whom data are disclosed, except to the extent where the individual's privacy rights override such interests. The activities of headhunters, investment bankers, and auditors are legitimate interests.