Do controllers have to include information on legitimate interests within their privacy notices or could they simply make this information available upon request?

When drafting employee privacy notices, it can sometimes be a complex exercise to list legitimate interests and doing so can add quite a bit of length to notices, which clients often want to avoid. It doesn't seem uncommon in recruitment privacy notices for larger companies which are available online to avoid listing legitimate interests but instead to include a brief description of it as a lawful basis (with no explanation as to what the legitimate interests actually are). Whilst strict compliance would require that legitimate interests are described, do you think that it is possible to avoid explaining this in the privacy notice and instead to say, for example, that further information is available on request?