Even if you can justify something with legitimate interest, which is a huge if, the data subject must be informed and have the option to object.