The interest might be theirs but the “legitimate” part absolutely has to incorporate a written justification somewhere within the the depths of the mandated records of processing activities that explains why the business/institution couldn’t possibly do what they’re doing without processing that particular piece of user data. “I want that” is not legitimate interest in the sense of Article 6.