Yes, I believe so. Legitimate interest is one of six legal bases that a company can use to process personal information—the others being required by contract, informed consent, binding corporate rules and public tasks. There are many legitimate bases for processing personal information. Legitimate interest is not meant to be an exception. It's one type of legal basis for collecting and processing data.
I think what has happened in Bill C-27—